A technical manual designed for corporate and college level courses in network forensics. It consist of twenty-three modules beginning with introductory concepts and topics in network monitoring, traffic analysis and event detection. It progresses through concepts and implementation of monitoring, collector placement and analysis tools to forensically examine captured network traffic. Review and construction of a local area network and virtualized enterprise network topologies are illustrated for full demonstration. This manual includes concepts of detecting TOR networks across the infrastructure and how SSL/TLS sessions between devices are identified using JA3 analysis. To be successful in this course students must have a functional knowledge of the OSI model, network protocols and TCP/IP handshaking.