Network Traffic Analysis with Wireshark Course

Lesson 1 • Installing and Configuring Wireshark

Covers installation on Windows, macOS, and Linux with privilege configuration. Ensures a functional capture environment before any hands-on work.

Lesson 2 • Saving and Managing Capture Files

Teaches pcap and pcapng file formats, file splitting, and basic file management. Students can preserve and share captures for collaborative analysis.

Lesson 3 • Capture Interfaces and Options

Explains interface selection, promiscuous mode, and capture buffer settings. Proper configuration here prevents data loss in all subsequent captures.

Lesson 4 • Navigating the Wireshark Interface

Maps every major UI panel and toolbar to its analytical function. Students gain fluency in the interface needed to work efficiently in later chapters.

Lesson 1 • OSI and TCP/IP Model Review

Maps OSI layers to TCP/IP layers and explains encapsulation. This framework is the reference model for every protocol discussed in the course.

Lesson 2 • Ethernet and Layer 2 Frames

Dissects Ethernet frame structure including MAC addresses and EtherType fields. Understanding Layer 2 is essential for interpreting raw captures.

Lesson 3 • ICMP and ARP Packet Structures

Analyzes ICMP message types and ARP request/reply mechanics. These protocols appear frequently in troubleshooting and attack scenarios.

Lesson 4 • TCP and UDP Header Analysis

Covers port numbers, flags, sequence numbers, and checksums for both transport protocols. Students distinguish normal from abnormal transport-layer behavior.

Lesson 1 • Filtering by IP, Port, and Protocol

Applies filter syntax to common analyst tasks: isolating hosts, services, and protocols. Students build filters for the most frequent real-world scenarios.

Lesson 2 • Display Filter Syntax and Logic

Teaches Wireshark's display filter language for post-capture packet isolation. Display filters are the primary tool for focused analysis in every chapter.

Lesson 3 • Capture Filter Syntax and Logic

Introduces BPF syntax used for capture-time filtering to limit collected data. Efficient capture filters reduce file size and processing overhead.

Lesson 4 • Advanced Display Filter Techniques

Covers string matching, byte offsets, and field existence checks for complex queries. These techniques handle edge cases that simple filters cannot address.

Lesson 1 • Exporting Objects and Files

Uses Wireshark's export objects feature to recover files transferred over HTTP, SMB, and FTP. Recovered files support deeper forensic investigation.

Lesson 2 • Following TCP and UDP Streams

Demonstrates stream reassembly to view full application conversations. This technique is foundational for all application-layer analysis tasks.

Lesson 3 • HTTP and HTTPS Traffic Analysis

Dissects HTTP request and response headers, methods, and status codes. Students identify web application behavior and detect anomalies in HTTP traffic.

Lesson 4 • DNS Query and Response Analysis

Examines DNS message structure, record types, and resolution timing. Students detect misconfigured resolvers and suspicious DNS patterns.

Lesson 1 • Measuring TCP Performance Metrics

Uses TCP stream graphs to measure throughput, RTT, and window scaling. Students pinpoint the root cause of slow TCP connections.

Lesson 2 • Wireshark Statistics Tools Overview

Surveys the Statistics menu: summary, protocol hierarchy, conversations, and endpoints. These tools provide the high-level view needed before deep-dive analysis.

Lesson 3 • Identifying Retransmissions and Errors

Filters for TCP retransmissions, duplicate ACKs, and out-of-order segments. These indicators reveal packet loss and congestion on the network path.

Lesson 4 • Building Traffic Baselines

Establishes normal traffic profiles using I/O graphs and conversation statistics. Baselines enable rapid detection of deviations in later security analysis.

Lesson 1 • Analyzing Encrypted Threat Traffic

Uses metadata, timing, and JA3 fingerprints to profile encrypted malicious sessions. Students assess threats without requiring full plaintext decryption.

Lesson 2 • TLS Handshake Dissection

Breaks down ClientHello, ServerHello, and certificate exchange packets step by step. Understanding the handshake is prerequisite to any TLS-based analysis.

Lesson 3 • Cipher Suite and Certificate Analysis

Evaluates negotiated cipher suites and certificate metadata for security weaknesses. Students flag deprecated algorithms and expired or self-signed certificates.

Lesson 4 • Decrypting TLS with Pre-Master Keys

Configures Wireshark to use SSLKEYLOGFILE for session decryption. Decrypted sessions expose application-layer content for full protocol analysis.

Lesson 1 • Reconnaissance and Scanning Detection

Identifies port scans, ping sweeps, and OS fingerprinting attempts in captures. Recognizing scan patterns is the first step in incident triage.

Lesson 2 • Denial-of-Service Attack Analysis

Analyzes SYN floods, UDP floods, and amplification attacks using traffic volume and pattern data. Students distinguish DoS traffic from legitimate bursts.

Lesson 3 • Credential and Data Exfiltration Detection

Locates cleartext credentials and large outbound data transfers in packet captures. Students build filters targeting exfiltration-specific traffic signatures.

Lesson 4 • ARP and DHCP Attack Detection

Detects ARP spoofing, ARP poisoning, and rogue DHCP servers from packet evidence. These Layer 2 attacks enable man-in-the-middle interception.

Lesson 1 • Handling Large-Scale Captures

Applies file splitting, ring buffers, and selective extraction to manage multi-gigabyte captures. Students maintain analytical performance on enterprise traffic volumes.

Lesson 2 • Automating Analysis with TShark and Shell

Combines TShark with shell scripting to automate repetitive extraction and reporting tasks. Automation reduces analyst time on high-volume capture processing.

Lesson 3 • Command-Line Capture with TShark

Uses TShark for headless capture, filtering, and field extraction on remote systems. TShark enables analysis in environments where a GUI is unavailable.

Lesson 4 • Writing Custom Wireshark Dissectors

Creates Lua-based dissectors to decode proprietary or undocumented protocols. Custom dissectors make Wireshark useful for specialized enterprise environments.