373 Network courses in Cardiff

Linux network administration 2 course description LPIC-2 is the second certification in LPI's multi level professional certification program. This course teaches the skills necessary to pass the LPI 202 exam; the second of two LPIC-2 exams. Specifically, the course covers the administration of Linux systems in small to medium sized mixed networks. What will you learn Install and configure fundamental network services. Linux network administration 2 course details Who will benefit: Linux administrators. Prerequisites: Linux engineer certification 1 (LPIC-2) Duration 5 days Linux network administration 2 course contents Part II The LPI 202 Exam Organizing Email Services The Linux Mail System, Mail Transfer Agent, Mail Delivery Agent, Mail User Agent, Email Protocols, SMTP, POP, IMAP, Using Email Servers, Sendmail, Postfix, Local Email Delivery, Procmail Basics, Sieve, Remote Email Delivery, Courier, Dovecot. DNS DNS and BIND, Configuring a DNS Server, Starting, Stopping, and Reloading BIND, Configuring BIND Logging, Creating and Maintaining DNS Zones, BIND Zone Files, Managing BIND Zones, Securing a DNS Server, ailing BIND, DNSSEC, TSIG, Employing DANE. Offering Web Services Web Servers, HTTP, The Apache Web Server, Installing and configuring Apache, Hosting Dynamic Web Applications, Secure Web Servers, Proxy Servers, Installing and configuring Squid, Configuring Clients, Nginx Server, Installing Nginx, Configuring Nginx. Sharing Files Samba, Configuring Samba, Troubleshooting Samba, NFS, Configuring NFS, Securing NFS, Troubleshooting NFS, FTP Servers, Configuring vsftpd, Configuring Pure-FTPd. Managing Network Clients Assigning Network Addresses, DHCP, Linux DHCP Software, Installing and configuring a DHCP Server and clients, Authentication Service, PAM Basics, Configuring PAM, PAM Application Files, Network Directories, LDAP Basics, OpenLDAP Server, LDAP Clients. Setting Up System Security Server Network Security, Port Scanning, Intrusion Detection Systems, External Network Security, iptables, Routing in Linux, Connecting Securely to a Server, OpenSSH, OpenVPN, Security Resources, US-CERT, SANS Institute, Bugtraq.

Python training course description This Python course focusses on teaching Python for use in network automation and network DevOps. We focus on getting delegates up and running with Python and network automation as quickly as possible rather than making them great programmers. In other words we concentrate on enabling delegates to use network automation libraries such as netmiko, NAPALM and Nornir, and APIs such as NETCONF and RESTCONF rather than enabling delegates to produce object oriented programs. Hands on sessions use Cisco and Juniper devices. What will you learn Run Python programs. Read Python programs. Write Python programs. Debug Python programs. Automate network tasks with Python programs. Configure network devices with Python. Collect data from network devices with Python. Python training course details Who will benefit: Network engineers. Prerequisites: TCP/IP Foundation Duration 5 days Python training course contents What is Python? Programming languages, Why Python? Python in interactive mode, Python scripts, ipython, Python version 2 versus version 3. A simple Python script. Comments. Hands on Installing Python, Hello world. A network example On box vs off box Python. telnet, ssh, NETCONF, HTTP, APIs, manufacturers and API support, analysis of a simple telnetlib program. Hands on Using Python to retrieve the configuration from a network device. Using wireshark to analyse the actions. Python basics I/O, operators, variables and assignment, types, indentation, loops and conditionals. Hands on Modifying the telnet program, changing configurations on a network devices. Functions, classes and methods What are functions, calling functions, builtin functions, useful builtin functions, file handling, classes, objects, creating instances. Hands on Storing configurations in files, configuring devices from files, using an inventory file to work on multiple devices. Libraries and modules Modules, files and packages, import, from-import, Python standard library, other packages, pip install, executing other programs. Managing python libraries. Hands on Using pip, installing and using ipaddress, subprocess to access netsnmp. For the more advanced, using the sockets library. Paramiko and netmiko SSH, enabling SSH on devices, keys. Paramiko versus netmiko, example scripts. pexpect. Hands on Configuring VLANs from Python. pySNMP Gathering facts using previous methods, SNMP review, pySNMP GET, pySNMP and SNMPv3. easySNMP library. Hands on Walking a MIB from Python. NETCONF What is NETCONF? Enabling NETCONF on devices, A first ncclient script, device handlers, get_config, edit_config, copy_config, delete_config, commit, validate, pyEZ, utils_config, utils.sw. Hands on Configuration using ncclient and PyEZ. This session is expanded for those interesting in JunOS automation. Manipulating configuration files Builtin functions, string handling. Unicode. Sequences, strings, lists, tuples. Dictionaries. TextFSM. Regular expressions. JSON, YAML, XML, YANG, Jinja2, templates. Hands on Jinja2 templating with Python to configure network devices. NAPALM Getters, configuration operations, supported devices, NAPALM transport, Config-replace, Config-merge, Compare config, Atomic changes, rollback. Example NAPLAM scripts. Hands on Using NAPALM to gather facts, Using NAPALM for configuration management REST and RESTCONF What is REST, HTTP methods, GET, POST, cURL, Postman, Python requests library. RESTCONF, a RESTCONF example. Hands on Modifying a configuration using RESTCONF. Scapy What is scapy, Scapy in interactive mode, Scapy as a module. Hands on Packet crafting from Python. Warning Errors and exceptions, Exception handling, try, except. Memory management. Garbage collection. Context management, With. Hands on Improving Python code. Nornir What is Nornir? A network automation framework, inventories, connection management and parallelization. Nornir architecture and other libraires. Hands on Setting up nornir, nornir fact gathering, nornir tasks. Optional Writing your own functions, Writing your own classes. pyntc. Hands on Writing reusable code.

Network forensics training course description This course studies network forensics-monitoring and analysis of network traffic for information gathering, intrusion detection and legal evidence. We focus on the technical aspects of network forensics rather than other skills such as incident response procedures etc.. Hands on sessions follow all the major sections. What will you learn Recognise network forensic data sources. Perform network forensics using: Wireshark NetFlow Log analysis Describe issues such as encryption. Network forensics training course details Who will benefit: Technical network and/or security staff. Prerequisites: TCP/IP foundation for engineers. Duration 3 days Network forensics training course contents What is network forensics? What it is, host vs network forensics, purposes, legal implications, network devices, network data sources, investigation tools. Hands on whois, DNS queries. Host side network forensics Services, connections tools. Hands on Windows services, Linux daemons, netstat, ifoconfig/ipconfig, ps and Process explorer, ntop, arp, resource monitor. Packet capture and analysis Network forensics with Wireshark, Taps, NetworkMiner. Hands on Performing Network Traffic Analysis using NetworkMiner and Wireshark. Attacks DOS attacks, SYN floods, vulnerability exploits, ARP and DNS poisoning, application attacks, DNS ANY requests, buffer overflow attacks, SQL injection attack, attack evasion with fragmentation. Hands on Detecting scans, using nmap, identifying attack tools. Calculating location Timezones, whois, traceroute, geolocation. Wifi positioning. Hands on Wireshark with GeoIP lookup. Data collection NetFlow, sflow, logging, splunk, splunk patterns, GRR. HTTP proxies. Hands on NetFlow configuration, NetFlow analysis. The role of IDS, firewalls and logs Host based vs network based, IDS detection styles, IDS architectures, alerting. Snort. syslog-ng. Microsoft log parser. Hands on syslog, Windows Event viewer. Correlation Time synchronisation, capture times, log aggregation and management, timelines. Hands on Wireshark conversations. Other considerations Tunnelling, encryption, cloud computing, TOR. Hands on TLS handshake in Wireshark.

Ansible training course description The course focusses on the use of ansible for network devices instead of its usual server use case. The course progresses from the basics of ansible and playbooks onto using network specific modules including NAPALM. The use Jinja2 templating with ansible is also studied. Hands on sessions with ansible configuring routers and switches follow all major sections. What will you learn Automate tasks with ansible. Write ansible playbooks. Configure network devices with ansible. Troubleshoot network devices with ansible. Use ansible network modules. Use jinja2 templates with ansible. Ansible training course details Who will benefit: Network engineers. Prerequisites: TCP/IP Foundation Duration 2 days Ansible training course contents What is ansible? The language, the engine, the framework. Uses of ansible, orchestration. Hands on Installing ansible, enabling SSH on network devices. Ansible architecture How ansible 'normally' works, Agentless, SSH, ansible and Python, modules, how ansible work on network devices, Configuration management, inventories, playbooks, modules, ansible.cfg. Hands on Getting started, running ad hoc commands. Playbooks ansible-playbook, users, YAML, plays, tasks, modules. ansible-vault. Hands on Running playbooks. More playbooks Handlers, variables, environmental variables, playbook variables, inventory variables, variable scope and precedence, accessing variables, facts, ansible vault. Conditionals, wait_for. Hands on Using variables and conditions in playbooks. Inventories /etc/ansible/hosts, inventory variables, static inventories, dynamic inventories. Hands on Inventories and variables. Ansible network modules Built in modules, custom modules, return values. ansible-doc -l. connection: local, Cisco modules, Juniper module, Hands on Using modules for your network devices. Ansible templatings The template module, the assemble module, jinja2 templates, for, if else. Hands on Configuring network devices from templates. Roles and includes Dynamic includes, Handler includes, playbook includes. Roles, role parts: handlers, files, templates, cross platform roles, ansible galaxy. Hands on includes example, building roles. Ansible and NAPALM Installation, napalm-ansible, NAPALM modules: napalm_diff-yang, napalm_get_facts, napalm_install_config, napalm_parse_yang, napalm_ping, napalm_translate_yang, napalm_validate. Hands on Using NAPALM modules in ansible.

Advanced Python training course description This course caters to network engineers aiming to enhance both their Python proficiency and network automation skills. Delving deeper into key areas such as netmiko, Nornir, and ncclient, we also focus on automating network testing and validation. Participants gain greater confidence working with Python functions, classes, objects, and error handling. The course additionally introduces more libraries like Scrapli, TTP, pyATS, Genie, pybatfish, and Suzieq, which cover parsing strategies, automation testing, validation, network analysis, observability, and telemetry. The curriculum also encompasses concurrency techniques. What will you learn Write Python modules and functions. Evaluate techniques to parse unstructured data. Use NETCONF filters. Handle Python errors effectively (try, assert…). Use postman. Automate testing and validation of the network. Use scrapli, Genie, batfish and Suzieq. Advanced Python training course details Who will benefit: Network engineers. Prerequisites: Python for network engineers Duration 5 days Advanced Python training course contents Review CLI, NETCONF, RESTCONF, structured versus unstructured data, gNMI and when to use which. PEP 8. Naming conventions. Packages, modules, Classes and methods. The scrapli library. Netmiko versus scrapli. Hands on: scrapli, Dictionaries versus Regular Expressions. Modules and Functions Writing your own modules, containers versus packages, virtual environments. Best practices, calling functions, writing your own functions. Parameters, arguments. Named arguments, dictionaries as arguments. Builtins. Docstrings. Main. __name__, __main__ . Program arguments. Hands on: Getting interfaces, showing interface status using Netmiko and functions. Using dictionaries as arguments. Writing your own modules. Parsing strategies Turning unstructured data into structured data. textfsm, PyATS Genie parser, NAPALM getters, Template Text Parser. Hands on: Genie parser, TTP. Accessing structured data with lists and dictionaries. Classes, objects and Python Python classes in Genie, PyEZ and others . Hands on: studying network automation classes, objects, methods and attributes. Configuration management - more nornir, ncclient, requests Nornir tasks. Nornir results, Nornir functions, Nornir plugins. Nornir processors. YANG, YANG models, pyang. NETCONF hello. Capabilities. Schemas. Filters. Subtrees. XPATH. Exploring available YANG data models. NETCONF and network wide transactions. Asserting NETCONF capabilities. Configuration types. Locking configurations, commits. NETCONF data stores. Netconf-console. RESTCONF differences from NETCONF. URI construction. Postman. More XML and JSON. Git and configuration versions. Hands on: Nornir and Jinja2. Exploring available models, NETCONF filters. Using postman. Python error handling and debugging Context handlers, try, assert, logging, pdb, pytest, unit testing, chatgpt. Hands on: Writing code with each of the error handling methods, investigating what happens on an error. Use chatgpt to debug your code. Python Automation Testing Testing and validation. pyATS, Genie. Testbed file. Genie parse, genie learn, genie diff. Genie conf, Genie ops, Genie SDK, Genie harness. Xpresso. Hands on: Using Genie for state comparisons of the network. Network analysis Batfish, pybatfish, configuration analysis, analysing routing, analysing ACLs. Pandas. Pandas dataframe. Filtering and selecting values of interest. Hands on: Use Batfish to analyse network snapshots, find network adjacencies, flow path analysis. Network observability Suzieq, using docker, using as a package. Sqpoller, suzieq-gui, suzieq-cli, sq-rest-server. Namespaces and seeing devices, network state and Asserts. Time based analysis, snapshots and changes. Hands on: Suzieq: Gathering data from the network, analysing data from the network. Network state assertion. Telemetry gRPC, gNMI. CAP, GET, SET. Subscriptions. Model Driven telemetry. Hands on: Analysing telemetry data with Python. Concurrency asyncio, threads, processes. Nornir concurrency. Scrapli and netmiko concurrency. Hands on: Multiple SSH connections to devices at same time. Scarpli asyncio.

Linux training course description A Linux foundation appropriate for all flavours of Linux, focussed on getting network engineers up and running with Linux. The command line is used throughout. The course progresses from the basics of Linux commands onto useful tools such as grep, then shell features such as piping and then onto shell scripting. Administration aspects covered are the tasks network engineers are most likely to encounter such as software installation. Hands on exercises concentrate on network related tasks such as installing net-snmp and using shell scripts to provide network automation. What will you learn Use Linux commands to perform a variety of tasks from manipulating files to handling processes. Create and edit files with vi. Work with permissions. Write simple shell scripts. Install software packages. Configure base networking. Linux training course details Who will benefit: Network engineers. Prerequisites: TCP/IP Foundation Duration 5 days Linux training course contents What is Linux? Linux distributions, open source software. Getting started Logging in, changing passwords, logging out. Hands on Basics and root access. Linux basics Command structure. The Linux manuals, basic commands (who, date, tty, uname, echo, banner...). Hands on Using the CLI. Connecting to a network IP configuration, DHCP, static addressing, routing, ifconfig, ping, netstat, traceroute, dig. Hands on Network configuration and testing. Managing Software Package Concepts, Comparison of package formats, RPM, rpm Commands, Yum, Debian Packages, dpkg, apt-cache, apt-get, dselect, aptitude, Converting Between Package Formats, Dependencies and Conflicts, Startup Script Problems, Shared Libraries, Library Management Hands on Installing network packages such as nmap and net-snmp. Processes and log files ps, kill, background processes, at, exec, priorities. Managing Linux log files. Syslogd. Setting the time. Cron and cronjobs. Managing Processes, the Kernel: The First Process. Hands on Controlling daemons and services. Setting up a TFTP server. Filesystem commands Home directories, manipulating files and directories, Filesystem layout, Pathnames, hard and symbolic links. Viewing files. Hands on Exploring the filesystem, working with network device configuration files. The Linux editors ed, vi, shell escapes, .exrc. Hands on Editing network device configuration files. Extracting data from files grep, find, cut, sort and paste… Hands on Working with syslog files. Permissions Theory, chmod, chown, newgrp. Hands on Handling permission problems. The shell Metacharacters, piping and redirection. Hands on Running SNMP commands and working with their output. Basic shell scripting What are shell scripts? Simple scripts, control structures. Variable. Setting variables, using variables, set, scope, export, sourcing, environmental variables, read. Positional parameters: $0 to $9, $#, $* and others. shift parameter substitution. Control statements: The test command, if , while loops, for loops, the case statement. Hands on Automating network tasks. Customising your environment Environmental variables, stty, .profile and other startup files. Hands on Customising Linux. Introduction to administration The root user, su. Managing users and groups. Hands on The power of root. Archiving files Backups, tar, cpio, dd, gzip. Hands on Working with tar files. Booting Linux and Editing Files Installing Boot Loaders, GRUB Legacy, GRUB 2, Alternative Boot Loaders, the Boot Process, Boot Messages, Runlevels and the Initialization Process, Runlevel Functions, Runlevel Services, Alternative Boot Systems , Upstart, system. Hands on Installing network services on Linux.

Network automation training course description This course concentrates on the technical side of tools and languages for network DevOps rather than the soft skills. These tools include Python, Ansible, Git and NAPALM By the end of the course delegates should be able to recognise the tools that they can use to automate their networks and be able to use the knowledge gained to feel confident approaching network automation. What will you learn Describe network DevOps. Choose network automation tools. Explain the role of various network automation technologies including: Python Ansible Git NAPALM Network automation training course details Who will benefit: Those wishing to learn about the tools of network automation. Prerequisites: Introduction to data communications. Duration 1 day Network automation training course contents What is DevOps and network automation Programming and automating networks, networks and clouds, AWS, OpenStack, SDN, DevOps for network operations. Unit testing. Hype vs reality. Benefits and features. Network monitoring and troubleshooting Traditional methods, SNMP. Netflow and xflow. Traditional automation. Streaming telemetry. Event driven automation. gRPC, Protocol buffers. Configuration management Catch 22 and initial configuration. ZTP, POAP. Traditional automation. TFTP. Ansible vs the rest (chef, salt, puppet). Jinja2 and templating. How ansible works. Network programmability Programming languages. Linux, shell scripting. Python vs the rest. Off box vs on box automation. Python network libraries Sockets pysnmp, ncclient, paramiko, netmiko, pyez, NAPALM. APIs Proprietary APIs, CLI, NETCONF, RETCONF. YANG, XML, YAML, JSON. Other tools Git, GitHub, Jenkins, JIRA and others.

Network fundamentals training course description An intensive hands on IP foundation leading to LINX Accredited Internet Technician stage 1. The course focuses on all parts of TCP/IP including layers 4 to 7 on end stations as well as layer 3 on routers. The TCP/IP protocols are also studied to enable delegates to be able to troubleshoot TCP/IP using Wireshark. Hands on sessions are used to reinforce the theory rather than teach specific manufacturer equipment. A multiple choice exam, leading to the LAIT I certification, is available after the course. The exam consists of 40 questions and lasts 1.5 hours. What will you learn Use ping, traceroute and other tools to diagnose faults on a network. Configure IP on PCs and routers. Plan IP addresses and subnets. Analyse IP and TCP packets using an analyser. Troubleshoot TCP/IP. Network fundamentals training course details Who will benefit: Network engineers. Prerequisites: None Duration 5 days Network fundamentals training course contents What is TCP/IP? TCP and IP are protocols, 7 layer model, network layers, hardware/software layers, internetworking, protocols, What is IP? What is TCP? The internet, The IAB, RFCs. Ping and Wireshark Host configuration, IP addresses, subnet masks, default gateways, ping. Hands on Base configuration. Testing with ping. Analysing packets with Wireshark. Switches and Wireshark Switches versus hubs, layer 2 forwarding table, flooding, broadcasts. Hands on Building a switched based network. Configuring network devices Configuration options, console port, putty, telnet. Hands on Configuring switches, telnet. IP IP packet format, protocol field, TTL, DiffServ, fragments, ICMP. Hands on IP packet analysis. IP addressing 32 bits, dotted decimal, rules, networks, role of subnet masks, simple subnetting, prefix notation. Broadcasts, special use addresses. Hands on Planning and implementing addressing. IP and the lower layers ARP, media not supporting ARP. Hands on ARP. Routing What are routers? What routers do, default gateways, routing and addressing, routing tables, ways to update routing tables. Hands on Building a routed network, traceroute. Routing protocols IGPs and EGPs, RIP, RIPv2, Why not to use RIP, OSPF, OSPF metrics, convergence, distance vector protocols, link state protocols. Hands on OSPF, analysing routing tables, loopbacks. Network simulators Network simulators, EVE-NG, GNS3, CML. Hands on Using EVE-NG. Subnetting Subnetting to the bit level, ranges, how prefixes are used. Hands on Subnetting. VLANS and IP addressing What are VLANs, tagging, 802.1Q, Inter VLAN routing. Hands on Inter VLAN routing. TCP and UDP Layer 4, port numbers, client ports, broadcasts multicasts and layer 4, UDP header, TCP header, connections, ACK, sliding windows, options, connection states. Sockets. Hands on Analysing TCP packets. IPv4 address configuration Private addresses, NAT, NAPT, dynamic addressing, DHCP, link local addresses. Hands on DHCP, NAT. IPv6 What is IPv6, 128 bit addresses, address formats, IPv6 address allocation, header format, migration, dual stack, tunnelling, NAT64, DNS64. Hands on IPv6 setup troubleshooting. IPv6 address configuration Static addressing, EUI-64 addresses, IPv6 address order, SLAAC, DHCPv6. Hands on SLAAC. Applications Clients, servers, HTTP, Email, resource sharing, VoIP, video, terminal emulation, remote desktop. Network management and SNMP. Hands on Servers, TFTP, VoIP packet analysis. DNS Names and addresses, hosts file, how DNS works. FQDNs, DNS client configuration. Hands on Troubleshooting DNS. Security Firewalls, firewall architectures, DMZ, how firewalls work, proxy servers, filtering, ACLs, IDS, VPNs, authentication, encryption, tunnels, secure protocols. Hands on Firewalls, SSH Troubleshooting Methods, tools. Using the 7 layer model. Troubleshooting toolkits. Hands on Fixing the network.

Jenkins training course description An introduction to Continuous Integration and development (CI/CD) in network automation using Jenkins. The course focusses specifically on the network Devops case of using Jenkins. What will you learn Explain how Jenkins can help with network automation. Configure Jenkins for network Devops. Use Jenkins for network automation. Jenkins training course details Who will benefit: Network engineers. Prerequisites: TCP/IP Foundation Duration 1 day Jenkins training course contents What is Jenkins? DevOps, CI/CD, version control systems, git, automating execution of tasks, Jenkins job, Jenkins pipeline, Jenkins plugins, CI server. Hands on Installing Jenkins. Example pipeline for network automation YAML, GitHub, Jenkins, ansible, network devices. Hands on Investigating a workflow: Auto deploying network configurations. Configuring Jenkins Code repository, build triggers, gerrit and reviews, build environment. A Jenkins job, build step, post build actions, running a Jenkins job, build log, home directory. Hands on Configuring Jenkins. CI using Jenkins Branches, pipeline, git, the git plugin. Hands on A Jenkins job to poll, build and unit test network configurations.

WCNA training course description Wireshark is a free network protocol analyser. This hands-on course provides a comprehensive tour of using Wireshark to troubleshoot networks. The course concentrates on the information needed in order to pass the WCNA exam. Students will gain the most from this course only if they already have a sound knowledge of the TCP/IP protocols. What will you learn Analyse packets and protocols in detail. Troubleshoot networks using Wireshark. Find performance problems using Wireshark. Perform network forensics. WCNA training course details Who will benefit: Technical staff looking after networks. Prerequisites: TCP/IP Foundation for engineers Duration 5 days WCNA training course contents What is Wireshark? Network analysis, troubleshooting, network traffic flows. Hands on Download/install Wireshark. Wireshark introduction Capturing packets, libpcap, winpcap, airpcap. Dissectors and plugins. The menus. Right click. Hands on Using Wireshark. Capturing traffic Wireshark and switches and routers. Remote traffic capture. Hands on Capturing packets. Capture filters Applying, identifiers, qualifiers, protocols, addresses, byte values. File sets, ring buffers. Hands on Capture filters. Preferences Configuration folders. Global and personal configurations. Capture preferences, name resolution, protocol settings. Colouring traffic. Profiles. Hands on Customising Wireshark. Time Packet time, timestamps, packet arrival times, delays, traffic rates, packets sizes, overall bytes. Hands on Measuring high latency. Trace file statistics Protocols and applications, conversations, packet lengths, destinations, protocol usages, strams, flows. Hands on Wireshark statistics. Display filters Applying, clearing, expressions, right click, conversations, endpoints, protocols, combining filters, specific bytes, regex filters. Hands on Display traffic. Streams Traffic reassembly, UDP and TCP conversations, SSL. Hands on Recreating streams. Saving Filtered, marked and ranges. Hands on Export. TCP/IP Analysis The expert system. DNS, ARP, IPv4, IPv6, ICMP, UDP, TCP. Hands on Analysing traffic. IO rates and trends Basic graphs, Advanced IO graphs. Round Trip Time, throughput rates. Hands on Graphs. Application analysis DHCP, HTTP, FTP, SMTP. Hands on Analysing application traffic. WiFi Signal strength and interference, monitor mode and promiscuous mode. Data, management and control frames. Hands on WLAN traffic. VoIP Call flows, Jitter, packet loss. RTP, SIP. Hands on Playing back calls. Performance problems Baselining. High latency, arrival times, delta times. Hands on Identifying poor performance. Network forensics Host vs network forensics, unusual traffic patterns, detecting scans and sweeps, suspect traffic. Hands on Signatures. Command line tools Tshark, capinfos, editcap, mergecap, text2pcap, dumpcap. Hands on Command tools.