Digital › Module 6 › Lesson 4
Lab — Net Logs
Network and logs lab on $DFIR_LAB — PCAP rows, log source map, EXIF/strings context; no unauthorized capture.
Visual · t26_net_logs_lab
Lab: net/logs pack on YOUR $DFIR_LAB practice case. Original Cyberlium.
Opening
Correlate one PCAP flow with two log sources and one EXIF row — all from YOUR authorized practice evidence.
On YOUR $DFIR_LAB per brief: (1) topology proof — case ID, image hashes, UTC sync note; (2) ≥3 PCAP rows with five-tuple and observed/inferred; (3) log source map — three sources with join keys linking to PCAP UTC window; (4) one EXIF or strings row from practice file with hash; (5) integrity block — $DFIR_LAB only, no unauthorized capture, no planted metadata; (6) chmod 600 pack. Use instructor synthetic or practice images only. No employer LAN taps, no forged logs, no live C2 interaction from PCAP IPs unless brief isolated sink.
1. Lab rows
PCAP + logs + EXIF/strings cross-index — minimum one correlation row tying two sources.
Link Module 3 hash discipline on every artifact exported.
Command guide
Try these commands — Lab rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Network + host correlation — https://www.sans.org/cyber-security-skills/digital-forensics/ tcpdump — https://www.tcpdump.org/manpages/tcpdump.1.html CISA IR — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install tcpdump
macOS: Built-in
Windows: Use Wireshark or install via WSL
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
tcpdump -r "$LAB_DFIR/pcap/lo-lab.pcap" -c 5 2>/dev/null | head -10 || echo 'Run 6-1 first for lo-lab.pcap'
journalctl -n 5 --no-pager 2>/dev/null | head -5 || head -5 "$LAB_DFIR/notes/fake-log-lines.txt"
grep -E 'Failed password|USB disconnect' "$LAB_DFIR/notes/fake-log-lines.txt"
sha256sum "$LAB_DFIR/pcap/lo-lab.pcap" 2>/dev/null | tee "$LAB_DFIR/pcap/lo-lab.pcap.sha256" || true═══ WINDOWS ═══
YOUR lab Windows VM — log literacy (no stranger pcap)
Command — copy this
Get-WinEvent -LogName System -MaxEvents 5 2>$null | Format-Table TimeCreated,Id,Message -Wrap Get-Content $HOME/cyberlium-lab/t26-dfir/notes/fake-log-lines.txt | Select-String 'sshd|kernel'
Primary tools to practice this lesson: tcpdump, journalctl, grep. Reference sites: Network + host correlation (https://www.sans.org/cyber-security-skills/digital-forensics/); tcpdump (https://www.tcpdump.org/manpages/tcpdump.1.html); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence hygiene
Redact external IPs and account names in share-safe copy; full detail chmod 600 mentor pack.
Label synthetic vs live practice per brief.
3. Teardown
Secure notes chmod 600; revert lab VM snapshot if brief requires.
No PCAP or log exports on removable media unencrypted.
4. What you ship: net/logs lab pack
PCAP rows + log map + EXIF/strings row + correlation + integrity — chmod 600.
5. What you record before the next lesson
Net/logs lab pack path.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Net/logs lab includes unauthorized employer SIEM export.
Right
Net/logs lab pack on $DFIR_LAB. Next: quiz.
Mission: net/logs lab
1) Topology and hash proof. 2) PCAP and log rows with join keys. 3) One EXIF/strings row. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum correlation row without overclaiming?”
Knowledge Check
APPLY: Net/logs lab scope:
Multiple choice
Knowledge Check
APPLY: True or False: Forged logs acceptable in net/logs lab.
True or False
Knowledge Check
APPLY: Correlation row ties:
Multiple choice