APNIC Training Team and Team Cymru

Abstract: 

This tutorial will look at the nature and structure of network attacks and the tools, actions and processes that can be used to identify and respond to such attacks. A brief overview examining the anatomy of an attack and the creation of botnets will be presented and the motivation that drives such on-line malicious activity, the type of tools that are used in modern attacks, who is behind these and the impact they have will be discussed. Identifying attack streams and understanding the nature of TCP/IP traffic will be discussed through the use of Wireshark, fprobe, nfsen and nfdump. Darknets and their operation and contribution to combating malicious network activity will be considered. As a practical, hands-on exercises, participants will be able to simulate a network attack and response scenario by trying to penetrate a remote network while at the same time protecting their own network from attack. This will be done using the tools and techniques discussed earlier and by remotely accessing either a virtual network topology or a real network running in the APNIC training lab.