O'Reilly logo

Learning Network Forensics by Samir Datt

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Chapter 6. Connecting the Dots – Event Logs

 

"We need to connect the dots to make the invisible visible"

 
 --Samir Datt

Just as we need to connect the dots to build a big picture, from a network forensics perspective, we need to correlate logs in order to get to the big picture of activity on a network. All devices that maintain logs of events are a great resource to track intruder activity. In our role as Network 007s, we will use these logs to try and track every step of the route taken by an intruder in our network.

Let's begin by trying to understand what logs are. A log, as the name suggests, is a record of information generated in response to a specific event or activity that occurs on a system or network. A log aims to capture the who, what ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required