Skip to content
CertGPS

GIAC Network Forensic Analyst

Proves you can trace an attack from network evidence alone, using packet captures, NetFlow, proxy logs and protocol analysis, in a hands-on CyberLive exam

AdvancedGIAC

The exam

Exam cost
$999
Study time
4-6 months
Passing score
70%
Valid for
4 years

Before you book

  • None listed by GIAC
  • Recommended: working knowledge of forensic methods, full-stack networking and Linux shell utilities (per SANS FOR572)

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

    • Principal Analyst
    • Director of Security Operations

Where it leads

  1. GIAC Certified Intrusion Analyst

    Advanced

    Comes before. Shifts from after-the-fact reconstruction to live intrusion detection and packet analysis

  2. GIAC Network Forensic Analyst

    You are here

Study guide

Last updated

GIAC GNFA Study Guide: Network Forensics and the FOR572 Exam

GNFA shows you can work out what happened in an incident from the network alone: proxy logs, NetFlow records, DNS and HTTP traffic, full packet captures and the metadata of encrypted sessions. It's the GIAC exam for SANS FOR572, with 66 questions in three hours and a $999 attempt. Its scope is wider than the title suggests: the objectives reach well past packet analysis into wireless networks, network architecture, logging pipelines and protocol reverse engineering, so Wireshark skill on its own won't carry you.

Who GNFA suits, and who should look at GCIA instead

GIAC aims GNFA at incident responders, forensic analysts, threat hunters, SOC staff, law enforcement, network defenders and engineers. It pays off most for someone who already investigates incidents and keeps hitting the limit of host evidence: the endpoint was reimaged, the logs rolled over, or the attacker used a device you can't image. SANS rates FOR572 at its advanced level. It names no prerequisite courses but expects working knowledge of forensic methods, networking from the physical layer up to user-facing services, and Linux shell tools.

If your job is watching traffic live and writing detections, GCIA is the better match; it's built around intrusion detection and packet analysis as it happens rather than reconstruction afterward. If you haven't done host forensics yet, GCFA covers that side, and the two courses share case scenarios.

GNFA exam facts

ItemGNFA
FormatOne proctored exam with CyberLive hands-on tasks in a virtual machine
Questions and time66 questions, 3 hours
Passing score70% (exam versions released on or after December 24, 2016)
Price$999 per attempt; $899 retake; $399 practice test
DeliveryRemote through ProctorU or on site at Pearson VUE, within 120 days of activation
Reference materialOpen book: printed books, notes and an index; no electronic files
PrerequisitesNone listed by GIAC
Validity and renewalFour years; 36 CPEs or a retake, plus a $499 renewal fee

The eight objectives

GIAC doesn't weight them, so here they are in the order FOR572 teaches them:

  • Network Architecture, and Open Source Network Security Proxies (section 1: proxy logs and evidence acquisition)
  • Common Network Protocols, and Security Event and Incident Logging (section 2: HTTP and DNS profiling, syslog, Windows Event Forwarding, log analysis in SOF-ELK)
  • NetFlow Analysis and Attack Visualization (section 3, with FTP reconstruction and SMB session analysis)
  • Wireless Network Analysis (section 4, alongside SMTP and full-packet hunting with NetworkMiner and Arkime)
  • Encryption and Encoding, and Network Protocol Reverse Engineering (section 5: TLS profiling without interception, undocumented protocols)

Common Network Protocols turns up in three of the five teaching sections, so expect HTTP, DNS, SMB and SMTP questions throughout rather than in one block. If your background is packet analysis, give the logging and proxy objectives extra time. GIAC's description of the certification says holders analyze application activity "through system logs, network traffic captures, and network metadata", and two of those three aren't packets.

The 70% pass mark comes from a standard-setting study that applies to exam versions released since December 24, 2016. GIAC says the CyberLive section comes at the end and that candidates who fail most of it shouldn't expect to pass; it doesn't publish the number of hands-on items.

How to prepare

FOR572, written by Phil Hagen, runs six days in class or 36 hours self-paced, with 20 labs and a day-long capstone that traces an attacker from entry to exfiltration using only network evidence. An attempt bought with the course adds two practice tests.

The course's main platforms are open source, so you can rebuild its lab at home:

  • SOF-ELK, Hagen's open-source virtual appliance built on the Elastic stack for log and NetFlow analysis, available on GitHub.
  • Arkime, the open-source full-packet capture and search platform FOR572 uses for hunting at scale.
  • tcpdump, Wireshark, NetworkMiner, nfdump and tcpflow, which also appear in the labs.

Capture your own traffic for a week on a home network, export NetFlow from it, and load both into SOF-ELK. Then answer the questions the objectives imply: which host talked to a new domain, what a TLS client's fingerprint looks like, how much data left over SMB. The course stresses shell scripting as a way to cut through millions of records, so get comfortable with grep, awk, sort and uniq on log files.

For background reading, Network Forensics: Tracking Hackers through Cyberspace by Sherri Davidoff and Jonathan Ham (Pearson, 2012) covers flow records, proxy reconstruction and wireless attacks. It dates from 2012, so read it for method and take your commands from the course books. Build your index around protocols and log formats; field names in proxy and NetFlow records are what you'll look up under time pressure. With 66 questions in 180 minutes you have nearly three minutes each, more than on GCFA, but the hands-on tasks will use it.

Renewal and next steps

GNFA is valid for four years. Renew with 36 CPEs or a retake, plus a $499 fee per cycle. SANS courses can cover all 36 CPEs; work experience, cyber ranges and NetWars count for up to 12 each. Renewal brings updated course books, but GIAC's FAQ says the FOR572 capture-the-flag lab data on USB B and C is limited to new course registrations.

Next certifications:

  • GCFA for host and memory evidence. SANS says most FOR572 labs were developed with the FOR508 authors.
  • GCIA if you want to move toward detection engineering and live traffic analysis.

Our view

GNFA is a specialist credential, and its value is that a whole exam is given over to network forensics. The open-source stack it teaches is a plus, since SOF-ELK and Arkime stay available to you after the exam without a license. The criticism is that the passing standard rests on a 2016 study while the course keeps adding tools, and that its audience is narrower than that of the host forensics exams. Take it if network evidence is a regular part of your investigations or you run a team that collects it. For a first forensics certification, it's the wrong place to start.

Sources