We begin with several fundamental CS concepts: binary network protocols, elementary cryptanalysis, and back engineering (reverse engineering/cleanroom design). We also have an intense but occasional focus on mathematics and information theory.
People who are not deep into mathematics and computer science will still benefit from this class, but those who have a passion for theoretical CS, information theory, or mathematics, will gain the most.
The class is presented as a series of technical challenges, each teaching a concept by allowing students to invent different approaches and try them out, seeing which work well and which do not. Challenges build on each other, until, by the final challenge, students are writing custom binary protocol decoder software from scratch.
Network Archaeology is a self-paced lab class, with intermittent instructor lectures. Some participants may find the first dozen or so labs easy: they are encouraged to proceed through as quickly as they like. The instructors lead occasional “how-to” lectures, starting with the first lab, eventually bringing the class to the same point. Between lectures, instructors traverse the room helping people with labs.
This class is taught using the Linux command line. The instructor will use command-line tools, to create increasingly powerful tools, but participants can make decent progress using Wireshark (local install) and Cyber Chef (web-based tool).
Each lab exercise either introduces new concepts or builds on previously presented concepts. Very few people make it through every exercise, and there is no expectation that anyone will “finish” in two days. Many Network Archaeology attendees come back to Cyber Fire to take this class a second or even third time.