- Overview of Network Protocols
- Sources of Evidence on a Network
- Overview of Physical and Data-link Layer of the OSI Model
- Evidence Gathering at the Physical Layer
- Tool: Windump
- Evidence Gathering at the Data-link Layer
- Tool: Ethereal
- Tool: NetIntercept
- Overview of Network and Transport Layer of the OSI Model
- Evidence Gathering at the Network and Transport Layer-(I)
- Gathering Evidence on a Network
- GPRS Network Sniffer: Nokia LIG
- NetWitness
- McAffee Infinistream Security Forensics
- Snort 2.1.0
- Documenting the Gathered Evidence on a Network
- Evidence Reconstruction for Investigation

Source:
http://www.eccouncil.org/EC-Council%20Education/Chfi-Course.htm

Don