GIAC Certified Intrusion Analyst credential artwork

GIAC Certified Intrusion Analyst (GCIA) Courses

Validates practical skills in network intrusion detection, including packet-level TCP/IP analysis, tcpdump, Wireshark, Snort, Zeek and network forensics.

GCIA tests packet-level traffic analysis, tcpdump and Wireshark, Snort and Zeek, so a good course teaches you to read traffic by hand and gives you labs and the books to build your exam index from. We compared the options on depth, hands-on practice and price.

Take SANS SEC503 when your employer pays; the exam is written from its books and labs. If you are paying yourself, you can buy the $999 attempt on its own and use Practical Packet Analysis to build Wireshark skills first.

CourseBest forFormatPrice
SANS SEC503: Network Monitoring and Threat Detection In-DepthEmployer-funded studyLive online$8,780
Practical Packet Analysis, 3rd EditionPacket analysis basicsBook$40
Employer-funded study

SANS SEC503: Network Monitoring and Threat Detection In-Depth

Six days live, or 46 hours self-paced, on traffic analysis, Snort, Zeek and network forensics, with 37 labs and a capstone. It is GIAC's affiliated course for GCIA, so the exam is written from its books and labs.

Great fit if your employer funds training and you want the books and labs the exam is written from

Poor fit if you are paying yourself and already work with packet captures daily; buy the attempt alone and self-study

Packet analysis basics

Practical Packet Analysis, 3rd Edition

Chris Sanders's 368-page guide to capturing and analysing traffic with Wireshark, with downloadable capture files so you can follow every example. It is a hands-on way to learn the packet-level skills the exam tests.

Great fit if you want hands-on packet analysis practice before or alongside the course

Poor fit if you already analyse packets daily; it starts from the basics

How to choose a GCIA course

  • Know which course the exam follows. GIAC names SEC503 as its affiliated course, and the exam is written from its books and labs. Any other route means you cover Snort, Zeek and traffic analysis yourself.
  • Plan for the open-book index. The exam allows printed books and notes but no laptops or electronic files. Build your index as you study, then test it with practice exams.
  • Get hands-on time. SEC503 has 37 labs and a capstone, and the exam includes CyberLive tasks in live virtual machines. Practice with real captures matters.
  • Weigh the price. SEC503 costs $8,780 and the GCIA attempt adds $999. The attempt alone is $999, and Practical Packet Analysis costs about $40.

Recommended GCIA course combinations

  • Employer pays: SANS SEC503 ($8,780) with the GCIA attempt ($999), which includes two GIAC practice tests when you add it to the course.
  • Self-study on a budget: Practical Packet Analysis ($40) for Wireshark skills, then SecurityPracticeTest's free GCIA sets (160 questions) before you buy the $999 attempt.
  • You read packets daily: SecurityPracticeTest's free sets and one GIAC practice test ($399) to check your index before the exam.
  • New to packet analysis: Practical Packet Analysis ($40) first, then SEC503 if your employer funds it.

Compare all GCIA practice tests →

GCIA course FAQ

What is the best GCIA course?

SANS SEC503, because the exam is written from its books and labs. It costs $8,780, so most people paying themselves self-study instead.

Can I pass GCIA without SANS SEC503?

Yes. You can buy the $999 attempt on its own, but you then cover traffic analysis, Snort and Zeek from other sources and build your own index.

How long does SEC503 take?

SEC503 runs six days live or 46 hours self-paced. Plan for about 100 hours of preparation in total, including building your index.

Is the GCIA exam open book?

Yes, for printed books and notes. Laptops, phones, electronic files and printed practice questions are not allowed.