CNFE study plan

Map each of the seven OSI layers to the specific packet fields and protocol behaviors a forensic analyst reads (Ethernet/ARP at L2, IP/ICMP at L3, TCP/UDP at L4, DNS/HTTP/TLS at L5-7)

Dissect TCP three-way handshake, sequence/acknowledgment numbers, and flag combinations by hand from a raw capture, then explain how retransmissions, resets, and half-open scans appear in flow records

Identify chain-of-custody requirements, order-of-volatility principles, and the difference between consent, subpoena, and warrant-based acquisition in a network context

Explain how Fourth Amendment reasonable-expectation-of-privacy analysis and organizational acceptable-use policies affect whether packet capture is lawful in an employer-owned network

Reconstruct a full DNS resolution chain from a capture, distinguishing recursive resolver queries, authoritative responses, NXDOMAIN, and tunneling indicators such as high-entropy subdomains and TXT-record abuse

Analyze HTTP request/response pairs to extract User-Agent strings, URI paths, POST bodies, and cookie/session artifacts that reveal attacker tooling

Explain how TLS metadata (SNI, certificate subject, JA3/JA3S fingerprints, cipher suites) supports attribution when payloads are encrypted

Compare DHCP, NTP, SMB, and RDP traffic patterns and describe which artifacts each leaves that survive in logs or captures

Configure a span/mirror port and a network TAP in a lab, documenting the tradeoffs of each in terms of dropped frames, duplex behavior, and evidentiary defensibility

Set capture filters versus display filters in Wireshark and tcpdump, and demonstrate how to size a ring buffer with multiple files to avoid packet loss during long acquisitions

Compute and verify SHA-256 hashes of capture files at acquisition, transfer, and analysis stages to prove integrity

Apply a tool-selection framework that weighs licensing, hash verification, timestamp handling, and output reproducibility across Wireshark, tcpdump, Zeek, and NetworkMiner

Extract indicators of compromise from malware traffic: beaconing intervals with jitter, DGA-like domain patterns, fast-flux DNS, and asymmetric upload/download byte ratios

Correlate IDS alerts from Snort/Suricata signatures with the underlying packets to separate true positives from noise, and write one custom rule that detects a specific behavior rather than a static string

Parse firewall, proxy, and DNS server logs to build a timeline of a single host's outbound connections

Explain how beacon jitter and sleep timers create detectable periodicity, and calculate inter-arrival statistics from a capture

Apply the NIST SP 800-61 incident response lifecycle to a network intrusion scenario, writing containment options (host isolation, ACL block, DNS sinkhole) with their tradeoffs

Build a log-analysis workflow that normalizes timestamps across time zones and clock skew before correlating events from multiple sources

Draft the scoping questions an investigator must answer first: initial access vector, dwell time, lateral movement path, and data exfiltration volume

Practice live-response triage order on a networked host: volatile memory, active connections, ARP cache, then disk

Document an examination so a third party could reproduce it: scope, tools and versions, commands run, hashes, and deviations from plan

Draft findings that separate observed fact from analyst inference, using language that survives cross-examination

Explain admissibility standards (relevance, authenticity, hearsay exceptions for business records, Daubert-style reliability factors) as they apply to network evidence

Anticipate and answer three likely cross-examination challenges to a packet-capture-based conclusion

Analyze an encrypted-traffic scenario using only metadata to infer command-and-control activity, documenting the reasoning chain

Identify protocol-anomaly indicators such as non-standard ports carrying standard protocols, malformed headers, and unexpected protocol sequencing

Compare exfiltration channels (DNS tunneling, HTTPS POST, ICMP payloads) and describe the artifact signature of each

Review your week 4 IOC package against new traffic and revise any indicator that produced false positives

Run a full timed practice examination under test conditions and score it by domain to locate remaining weak areas

Re-drill the two lowest-scoring domains using targeted labs rather than rereading notes

Assemble a one-page exam-day reference of legal standards, volatile-order rules, and hash-verification steps

Finalize a personal tool and command cheat sheet you can recall without reference material