The next session of TCP/IP Weapons School 2.0 will take place in Amsterdam on 14-15 April 2009 at Black Hat Europe 2009. Richard Bejtlich is using the same material to teach analysts on his team how to detect and respond to intrusions. He has retired TWS, the class he taught from 2006-2008, and is only teaching TWS2 for the foreseeable future. To provide a better sense of the class, I’ve posted materials from one of the labs here.”]
Source: https://taosecurity.blogspot.com/2009/02/sample-lab-from-tcpip-weapons-school-20.html