1. Explain how encrypted information being transmitted on wireless network can still be used to assist in Network Forensics.

2. What forensic value can one obtain from a switch?

3. Why are routers considered a rudimentary intrusion detection system?

4. How could an investigator use information from a DHCP server to help in a forensic investigation?

5. What aspect of a DNS server log can a network investigator?

6. How can one use authentication server logs to help identify unauthorized penetration attempts?

7. What is the difference in capabilities between early system firewalls and current modern firewalls? (Hint: Capabilities?)

8. What characteristics of a Web Proxy make it appealing to forensic investigators?

9. What is the role of a central log server?

10. List and briefly describe the most commonly used software libraries for recording, parsing, and analyzing captured packet data.

11. Which tools are commonly associated with the software libraries you identified in the previous question?

12. What are the qualifiers for the Berkeley Packet Filter (BPF)?

13. What are some of the reasons tecpdump is such a powerful network forensic tool?

14. What is the purpose of Wireshark?

15. What is tshark?