GNFA practice labs, one capture at a time
The GNFA objectives expect an analyst who can open a packet capture and tell the story in it: follow streams, read protocols in the clear, find data leaving over HTTP, spot a beacon by its timing, recover cleartext credentials, and connect network evidence to what the hosts recorded.
This pathway opens with a single capture and a few protocols. It then measures traffic in a capture and ties it to host artifacts, ties a remote-access login to scheduled outbound traffic, follows a host from an opened document to its outbound traffic, and follows a download from the browser into the network and memory. The capstone is a multi-department breach where the network evidence has to be reconciled with host and mobile artifacts.
6 cases · ~19 h 9 min of lab time · Easy to Expert · a different variant for everyone · verified answer keys
The pathway, in order
6 cases, about 19 h 9 min of lab time. Each step opens the case in the library, where you can read the brief, the evidence list and sample questions. Everyone gets a different variant of the same case, graded against a key that was verified in the evidence.
-
01
First Look: Reading a Packet Capture
Follow streams and read protocols in a capture.
EASY~33 minUp to 15 questions -
02
Open Channel (Exfiltration to a Personal Server)
Measure traffic in a capture and tie it to host artifacts.
MEDIUM~1 h 25 minUp to 20 questions -
03
Tunnel Vision (VPN Account Compromise and Beacon)
Tie a remote-access login to scheduled outbound traffic.
HARD~1 h 54 minUp to 20 questions -
04
Patient Zero (Phishing to Malware to Command and Control)
Follow a host from an opened document to its outbound traffic.
HARD~2 h 39 minUp to 25 questions -
05
Trust Fall (The Urgent Update)
Follow a download from the browser into the network and memory.
HARD~2 h 14 minUp to 20 questions -
06
Open Records (Municipal Breach)
Capstone: network evidence in a multi-department breach.
EXPERT~10 h 24 minUp to 35 questions
What this pathway covers
Who it's for
- Candidates preparing for the GNFA who want to work captures in Wireshark, Zeek or tshark with a verified answer to check against.
- Instructors teaching network forensics who need captures that differ per student but grade to the same rubric.
- SOC analysts moving into packet analysis who can read an alert and want to prove the traffic behind it.
What you get with every case
- A different variant per student. Same case, same rubric, different names, hashes, timestamps and answers, so students can talk about method without sharing answers.
- Evidence in the real on-disk format. Registry hives, EVTX, PCAP, SQLite, JSON audit logs and memory images open in the tools the exam expects.
- A verified answer key. Every answer is re-derived from the planted evidence before the lab ships, so grading disputes end at the artifact.
- One-click grading and LMS export. Canvas, Blackboard, Moodle, D2L and LTI 1.3 grade passback, or a CSV. See the student portal.
- Runs on the instructor's machine. Windows installer plus macOS and Linux, fully offline after activation. Nothing to host and no student data leaves the room. Course packs on courses.
Run this pathway with your own roster
Download the app, generate a three-student version of the first case in under five minutes, and grade it. First Look cases run free with no key, and the 30-day trial needs no card. Or open the sample lab first and work a student package in your own tools.
Related pathways
Linux Forensics
Investigating a Linux host and server: logins, persistence, and web-server intrusion.
5 cases · ~5 h 34 min · SANS FOR577
macOS Forensics
Investigating an Apple endpoint: download provenance, privacy consent, persistence, and insider exfiltration.
6 cases · ~6 h 3 min · SANS FOR518
All learning pathways
Every certification-prep and role pathway across Digital Forensics and Incident Response, side by side.
Browse the overview →
GIAC, GCFE, GASF, GNFA, GCIH, GCFR and GCFA are trademarks of GIAC. CompTIA and CySA+ are trademarks of CompTIA, Inc. SANS is a trademark of the SANS Institute. Red Herrings aligns its pathways to the published objectives of these programs for teaching; it's independent of, and not affiliated with or endorsed by, any certification body.