Cyber Defence Monitoring Course Suite Module 3


Cyber Defence Monitoring Course Suite Module 3


9-13 May 2016

Registration deadline:

4 Apr 2016



Tallinn, Estonia

Number of participants:


Participation fee:

300 € (no fee for the Sponsoring Nations, Contributing Nations and NATO bodies)

CDMCS Module 3: Large-Scale Packet Capture Analysis Course

Locked Shields technical environment is very complex and blue teams need network traffic overview to plan their strategy. It is also essential to have an overview of what happened in the network during the execution. This course will make use of the latest Locked Shields execution network traffic capture as a learning material.

This intensive hands-on course concentrates on a single solution out of a number of important Cyber Defence Monitoring techniques and solutions. We will focus only on packet capture and analysis. It is not meant to replace IDS engines but instead work alongside them to store and index all the network traffic and providing fast access to the captured data. We use Moloch, an open-source free software tool, to build network security monitoring for different scales - from SOHO/SME up to enterprise level.

The Course demonstrates how Moloch is a perfect fit into modern network security monitoring. Attendees gain practical experience on how to build up a scalable system and how challenging the security-engineering and analysis process can be.


    • Methods used to conduct network traffic analysis.
    • Installing a single instance for small office network.
    • Building from source to get a custom set of required features.
    • Controlling a large setup.
    • Using APIs for integration.
    • Using proxies/aggregators to get data from external sources.
    • Scaling up to 10Gb+.
    • Scaling up months of history.
    • Separation concerns.

    In this course we will work with network traffic from the recent Locked Shields 2016, this means the traffic will have real intrusions.


    • Locked Shields 2016 Blue Team members and/or national representatives.
    • Good understanding of TCP/IP networking and network/system administration.
    • Recent everyday network/system administrator's work experience of at least 2 years in UNIX environments. 
    • Previous detailed knowledge on following topics: work principles of UNIX operating systems and UNIX file system layout, common UNIX shells (e.g., sh, bash), common UNIX user tools (e.g., ls, ps, kill), common UNIX system administration utilities.
    • Scripting experience is required.
    • Previous programming experience is not required, but is helpful.
    • English language skill comparable to STANAG 6001,

    NB! We most strongly discourage the participation of students who do not fulfil aforementioned prerequisites, since the course contains advanced lab sessions assuming this knowledge. Therefore, the presence of unskilled attendants in the audience is likely to hinder the overall progress of the course.

    Students can take each module in the course suite independently. However, the Centre encourages the applicants to attend all three modules in order to have a complete overview of available methods, techniques, and their implementation.

    Registration info

    To sign up for the course, please complete the registration form before the deadline.