Wireshark Training

Lesson 1 • Starting and Stopping Captures

Teaches how to select interfaces and control capture sessions. Connects interface selection to the types of traffic visible in each capture.

Lesson 2 • Navigating the Wireshark Interface

Introduces all major UI panels and toolbar controls. Students gain confidence moving through the interface before capturing live traffic.

Lesson 3 • Wireshark Installation and Setup

Guides installation on Windows, macOS, and Linux with required dependencies. Ensures every student has a functional, correctly configured Wireshark environment.

Lesson 1 • Understanding Display Filters

Covers Wireshark's display filter language for post-capture analysis. Students apply filters to large captures without discarding any packets.

Lesson 2 • Advanced Display Filter Techniques

Introduces complex expressions, slicing, and regex matching in display filters. Enables precise isolation of anomalous or protocol-specific traffic patterns.

Lesson 3 • Understanding Capture Filters

Explains BPF syntax used to limit traffic collected at capture time. Reduces noise before data is stored, improving performance on busy networks.

Lesson 1 • Ethernet and ARP Analysis

Examines Layer 2 frames, MAC addressing, and ARP request/reply cycles. Provides the link-layer context required for higher-layer protocol interpretation.

Lesson 2 • UDP and ICMP Behavior

Analyzes connectionless UDP datagrams and ICMP control messages. Connects these protocols to DNS, DHCP, and network diagnostic workflows.

Lesson 3 • IP Header Deep Dive

Dissects IPv4 and IPv6 header fields including TTL, flags, and fragmentation. Students correlate header values with routing behavior and packet loss indicators.

Lesson 4 • TCP Flow Control and Windowing

Explains receive window scaling, zero-window conditions, and congestion signals. Students recognize throughput bottlenecks directly from TCP header values.

Lesson 1 • FTP and SMTP Protocol Inspection

Analyzes plaintext FTP commands and SMTP message exchanges. Highlights credential exposure risks in unencrypted application protocols.

Lesson 2 • HTTP and HTTPS Traffic Analysis

Decodes HTTP request and response headers, methods, and status codes. Introduces TLS handshake visibility and limitations when analyzing encrypted traffic.

Lesson 3 • DHCP Lease Process Analysis

Traces the DORA sequence and DHCP option fields in captures. Students verify correct IP assignment and diagnose lease failures from packet data.

Lesson 1 • IO Graphs for Traffic Visualization

Builds time-series graphs of packet rates, byte rates, and filtered streams. Students correlate traffic spikes with specific events in the capture timeline.

Lesson 2 • Capture File Summary Statistics

Explores the Summary, Protocol Hierarchy, and Conversations dialogs. Provides a rapid overview of capture composition before deep-dive analysis begins.

Lesson 3 • TCP Stream Graphs and Analysis

Uses Stevens, throughput, RTT, and window-scaling graphs for TCP sessions. Students diagnose retransmission storms and window stalls from visual patterns.

Lesson 1 • Measuring Latency with Wireshark

Calculates round-trip time and server response time from TCP timestamps. Students distinguish network latency from application processing delays.

Lesson 2 • Bandwidth and Throughput Analysis

Measures actual throughput against theoretical capacity using IO graphs and TCP graphs. Students identify bottlenecks caused by window size, MTU, or congestion.

Lesson 3 • Wireless Network Troubleshooting

Captures 802.11 frames in monitor mode and interprets signal and retry fields. Students diagnose wireless-specific issues invisible in wired captures.

Lesson 4 • Diagnosing Slow Application Performance

Isolates application-layer delays from network-layer delays using time columns. Students build a structured methodology for slow-application investigations.

Lesson 1 • Credential and Data Exfiltration Detection

Extracts credentials from plaintext protocols and detects large outbound transfers. Students apply filters to surface data theft indicators in captures.

Lesson 2 • Malware and C2 Traffic Patterns

Analyzes beaconing intervals, DNS tunneling, and unusual protocol usage. Students recognize command-and-control communication patterns in captured traffic.

Lesson 3 • Detecting Network Reconnaissance

Identifies port scans, ping sweeps, and OS fingerprinting attempts in captures. Students distinguish scan types by their TCP flag and timing signatures.

Lesson 4 • Intrusion Evidence Documentation

Structures packet-level evidence into a defensible incident report. Students export marked packets, annotate findings, and preserve capture integrity.

Lesson 1 • Automating Analysis with Python and PyShark

Uses PyShark to parse PCAP files programmatically and extract metrics. Students build scripts that automate repetitive filtering and reporting tasks.

Lesson 2 • TShark Command-Line Analysis

Uses TShark to capture, filter, and export data without the GUI. Enables scripted, automated analysis of large capture files in server environments.

Lesson 3 • Decrypting TLS Traffic

Configures Wireshark to decrypt TLS sessions using pre-master secret logs. Students analyze HTTPS, encrypted DNS, and other TLS-wrapped protocols.

Lesson 4 • Lua Scripting for Custom Dissectors

Introduces Lua scripting to parse proprietary or undocumented protocols. Students write a basic dissector that registers fields in the Wireshark protocol tree.