🔍 Network Forensics Certification · 2025

GIAC Network Forensic Analyst (GNFA)

Master the art of network forensic investigation. GNFA validates the ability to perform advanced analysis of network forensic artifacts — understanding normal and abnormal network activity, processing network traffic captures and metadata, reversing unknown protocols, and analysing application activity through security event logs and network sensors.

Network Forensics Packet Analysis NetFlow Protocol RE Security Logging Wireless Analysis Encryption & Encoding

Enroll Now

Network Architecture & Protocol AnalysisProtocol behaviour, security risks, and RE techniques

NetFlow Analysis & Attack VisualisationNetFlow data and information sources to identify attacks

Encryption, Encoding & Security ProxiesEncoding/encryption analysis and network proxy architecture

Security Event & Incident LoggingLog formats, aggregator deployment, and log analysis

Exam Questions

3 hrs

Duration

70%

Passing Score

GIAC

Certified

Why It Matters

Network Evidence Is the Foundation of Every Major Investigation

Every attack leaves traces in network traffic. GNFA-certified analysts can extract, interpret, and present that evidence — whether for incident response, threat hunting, or legal proceedings. It is the gold standard for network forensics expertise.

Trending

Critical

Network Forensics Underpins Every Major IR Investigation

From APT intrusions to insider threats, every significant incident leaves a network evidence trail. GNFA analysts are the specialists who can reconstruct what happened from packet captures and logs.

Wireless

Covers Wireless Network Forensics and Protocol Analysis

GNFA covers both wired and wireless network forensics, including identifying and controlling risks in wireless infrastructure — a critical skill as wireless attack surface continues to expand.

Trending

Deep

Protocol Reverse Engineering for Unknown Traffic

GNFA-certified professionals can analyse and reverse-engineer unknown or obfuscated protocols traversing a network — essential for investigating sophisticated malware and covert channel attacks.

Broad

Valued by IR Teams, SOCs, Law Enforcement, and Forensics Firms

GNFA is one of the few certifications that bridges corporate IR, government law enforcement, and professional forensics — validating expertise applicable across all these high-demand sectors.

Course Content

Complete GNFA Curriculum

Click any module to expand and explore the topics covered in detail.

Network Architecture, Protocols & Protocol Reverse Engineering

5 Topics

Common network protocols — behaviour, security risks, and applied forensic analysis

Designing and deploying networks using diverse transmission and collection technologies

Tools and techniques required to analyse diverse protocols and data traversing a network

Network protocol reverse engineering — identifying and interpreting unknown or obfuscated protocols

Network analysis tools and their application in forensic investigations

Encryption, Encoding & NetFlow Analysis

5 Topics

Encoding and encryption techniques used in common network traffic and attacks on those controls

Identifying encrypted and encoded traffic in packet captures for forensic investigation

NetFlow data analysis and the use of information sources to identify and attribute network attacks

Attack visualisation using NetFlow metadata and traffic analysis tools

Open source network security proxies — architecture, log formats, and data flow in network environments

Security Event & Incident Logging

5 Topics

Diverse log formats, protocols, and the security impact of event-generating processes

Configuration and deployment strategies for securing logging aggregators and collection devices

Positioning log collection infrastructure throughout a network for maximum forensic value

Correlating security events across log sources to reconstruct attack timelines

Log retention, integrity, and chain of custody requirements for forensic use of log data

Wireless Network Forensics

5 Topics

Identifying and controlling the risks associated with wireless technologies, protocols, and infrastructure

Wireless packet capture and analysis — tools and techniques for wireless forensic investigation

Common wireless attacks and their network-level indicators in packet captures

Wireless network architecture review — identifying security weaknesses through traffic analysis

Integrating wireless evidence with wired network forensics for complete incident reconstruction

FAQs

Frequently Asked Questions

What is the GIAC Network Forensic Analyst (GNFA) certification?

GNFA validates the ability to perform advanced analysis of network forensic artifacts. Certified professionals demonstrate the ability to understand fundamental network forensics practices, process and interpret normal and abnormal network activity, and analyse application activity through system logs, network traffic captures, and network metadata.

What are the GNFA exam requirements?

The GNFA exam consists of 66 questions, is web-based and proctored, has a 3-hour time limit, and requires a minimum passing score of 70%. Proctoring is available via ProctorU (remote) or PearsonVUE (onsite).

What topics does GNFA cover?

GNFA covers common network protocols, encryption and encoding analysis, NetFlow analysis and attack visualisation, network architecture, protocol reverse engineering, open source network security proxies, security event and incident logging, and wireless network forensics.

Who should take the GNFA certification?

GNFA is designed for incident response team members, forensic analysts and specialists, threat hunters, law enforcement officers and federal agents, SOC personnel, information security practitioners and managers, network defenders and engineers, and IT professionals who need to perform network forensic analysis.

How does GNFA compare to other GIAC forensics certifications?

GNFA focuses exclusively on the network layer — packet captures, traffic analysis, network logs, and protocol forensics. It complements host-based forensics certifications and is particularly valuable for investigators who need to reconstruct network-level attack activity and timeline evidence.

Is GNFA useful for threat hunting roles?

Yes — GNFA is directly applicable to threat hunting. It trains professionals in NetFlow analysis, traffic baselining, and anomaly detection at the network level, which are core skills for threat hunters performing network-based adversary hunting in enterprise environments.

Become a Network Forensic Analyst with GNFA

Join Zetlan Technologies' GNFA programme and master the network forensic skills that power the most demanding IR, threat hunting, and law enforcement investigations. Earn your GIAC certification and become the expert who reads the network.

GIAC Network Forensic Analyst (GNFA)

Network Evidence Is the Foundation of Every Major Investigation

GNFA Exam Details

Complete GNFA Curriculum

Built for Network Investigators, IR Teams & SOC Analysts

Frequently Asked Questions

Become a Network Forensic Analyst with GNFA