Richard Taosecurity’s Network Security Operations class is based on material in The Tao of Network Security Monitoring. At USENIX, he has to scale back the hands-on material because he can’t provide laptops and there are many more students. By the end of day one students should know what network data to collect, how to access it, and what tools to capture and analyze it. By day three students will know how to turn collected packets into real network-based evidence during incident response.”]
Source: https://taosecurity.blogspot.com/2005/09/network-security-operations-class.html