Network Forensics

This got me wondering recently – why do our local experts seem to fail at the most fundamental knowledge? I had the occasion to attend a training on network forensics and by the time we had our first exercise, I had to correct the instructor because he was explaining something fundamentally wrong to the audience. His explanations actually violated the basic rules of networking.

I am not saying that he was stupid. In fact, I gave him a good feedback at the end. I would consider him as someone who actually had practical experience in the field and knows both the technical and non-technical stuff. However, what caught me was that a renowed expert in the field could actually get his fundamentals wrong to the extent that a practitioner like me could spot it immediately.

This was not a case of lack of preparation because after I raised the issue and pointed it out to him, he actually argued it with me and I had to prove that he was wrong. I certainly hope that I do not get caught in such a situation in the future but I have learned from him how to handle such blunders, gracefully.

After the short training, I actually got to learn a few new things, which was good. It was also an interesting training because we got to actually do some network attacks and see the results of other network attacks. We managed to hijack each other’s traffic, learned how to steal accounts and listened in on VoIP conversations. Some of us were tempted to try the techniques over lunch at a public hotspot!

It was quite fun and I may integrate some of that learning into my future projects.