The emerging need for facilities and curriculum to prepare students and practitioners to understand, anticipate, and investigate malicious activity conducted using Internet based services and infrastructure is emerging as a high interest area and increasing in importance. Curriculum development focusing on host forensics has been discussed and written about frequently in the recent past. However the area of network forensics has largely not been included. We document in this paper our efforts at creating a physical laboratory and describe the integration of practical, example based network focused curriculum.