NetworkNetwork & Cloud ForensicsNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.DCNI Network Investigator
The DCNI is for investigators who need to read what passed over a network. It covers packet capture, Wireshark and the traffic and log analysis behind intrusion and data theft cases.
DCNINetwork Investigator
What a holder can show
- Capture traffic correctly with tcpdump and Wireshark and hash the capture files
- Follow TCP streams and decode common protocols such as DNS, HTTP and SMB
- Spot scanning, brute force attempts and data leaving the network
- Carve files and credentials out of captured traffic
- Read firewall, proxy and server logs alongside packet data
- Build a timeline of an intrusion from network evidence
- Explain network findings in plain words in a report
About the DCNI
When a company server starts talking to an unknown address at two in the night, the disk may show nothing unusual. The network does. Packet captures and logs record who connected to what, when and how much data moved. That is often the only way to prove that data left an organisation.
The DCNI path covers network traffic analysis and Wireshark packet capture. You learn to capture traffic without losing packets, read protocols at the level an investigator needs and connect what you see in packets with firewall and server logs.
Who Should Take It
- Network and system administrators who handle security incidents
- SOC analysts who want to move from alerts to investigation
- Cyber cell officers dealing with intrusion and data theft complaints
- Digital forensic analysts adding network evidence to their work
- Students with a networking background
How to Earn It
- 01Choose the certification
Select the DCNI on the certifications page. If you are not sure it is the right level for you, talk to a counsellor first.
- 02Enrol
Fill in the enrolment form and complete the payment. You then get access to the course material and labs on the DFRTI student portal.
- 03Study and practise
Work through the Network Traffic Analysis and Wireshark / Packet Capture courses. The portal has video lectures, notes, lab exercises, quizzes and exam preparation material.
- 04Schedule the exam
Book your exam through the DFRTI portal when you feel ready.
- 05Get your certificate
Your certificate carries a unique ID. Anyone can enter that ID on the DFRTI verification page and confirm it online.
What Is Assessed
DFRTI exams combine multiple-choice questions, practical lab work, case study analysis and tool-based exercises, all within a set time. The exact structure depends on the certification.
- Theory questions
Multiple-choice questions on the TCP/IP model, common protocols, capture methods and log sources.
- Practical lab
Analyse a packet capture from a simulated attack and find the attacker's address, method and what was taken.
- Case study
Work out how a phishing email led to a compromised office PC from the network records alone.
- Tool-based exercise
Answer set questions using Wireshark, NetworkMiner and Zeek logs.
DCNI Questions
Do I need a networking background?
It helps. DFRTI asks for the prerequisite courses or equivalent experience for intermediate and advanced certifications. If you are not comfortable with IP addresses, ports and protocols yet, a counsellor can suggest where to begin.
Does the DCNI cover cloud accounts and virtual machines?
The DCNI focuses on network traffic and packet analysis. Cloud storage and virtual machine investigations are covered by the Cloud / Network Forensics Certificate, which many DCNI holders take next.
Can I retake the exam if I do not pass?
Yes. DFRTI allows retakes and the number of attempts depends on the certification. A counsellor can explain the current retake rules before you enrol.
How can an employer check my certificate?
Every DFRTI certificate has a unique ID. The employer enters it on the DFRTI verification page and sees at once whether the certificate is genuine.
Related courses
NetworkNetwork & Cloud ForensicsNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.
NetworkNetwork & Cloud ForensicsWireshark / Packet CaptureCapture, filter and read packets in Wireshark and tshark to recover what was sent.More in Certifications
Not sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.