TCP/IP Network Traffic Analysis with Wireshark Training Course

Day 1

Overview of Network Analysis

1. Essentials of the OSI Reference Model and TCP/IP networks.
2. Troubleshooting tools and methodologies.
3. Introduction to Wireshark
4. Understanding Wireshark: Portable versions and available resources.
5. Wireshark GUI layout: Panes (Packet List, Details, Packet Bytes), Status Bar, etc.
6. Architecture and processing flow: What cannot be seen with Wireshark and why?
7. Supported protocols and dissectors.
8. Preferences and configurations: Global settings and profile-specific options.
9. Working with time values.
10. Lab exercises.

Day 2

Capturing Traffic

1. Key considerations before starting a capture.
2. Promiscuous mode.
3. Capture filters.
4. Automatic stop criteria.
5. Remote capture techniques.
6. Lab exercises.

Traffic Analysis: Tools and Approaches

1. Analysis checklist.
2. Utilizing features: name resolution, colorization, marking, ignoring, commenting, time references, time shifts, etc.
3. Understanding the Expert System.
4. Accessing options via right-click functionality.
5. Interpretation (reference patterns) and understanding the impact of OS/driver offload features.
6. Saving results.
7. Lab exercises and case studies.

Day 3

Traffic Analysis: Tools and Approaches (Continued)

1. Filtering traffic: Display filters (creating "in-flight" filters and macros), following streams.
2. Quantitative analysis.
   1. Basic predefined descriptive statistics and summaries: Capture Properties, Protocol Hierarchy, Conversations, Endpoints, Packet Lengths, IP-specific data.
   2. Protocol-specific analysis (e.g., TCP Stream Graphs).
   3. Advanced custom statistics using I/O Graphs.
   4. Flow visualization.

Day 4

Traffic Analysis: Protocols

1. Data-Link Layer: Ethernet II.
2. Network Layer: IPv4.
3. Transport Layer: TCP, UDP.
   1. Packet loss and recovery mechanisms.
   2. Events involving lost previous segments and out-of-order segments.
   3. Duplicate ACKs and Fast Retransmissions.
   4. TCP Retransmissions.
   5. Zero Window, Window changes, and other window-related problems.
4. Application Layer: HTTP, FTP.
5. Lab exercises and case studies.

Day 5

Traffic Analysis: Common Issues in Network Performance Assessment

1. Causes of performance problems.
2. Packet loss.
3. Bandwidth issues: A layered approach to measurement.
4. Latency: Assessing end-to-end latency and visualization.
5. Lab exercises.
6. (Wireshark) command-line tools:
   1. tshark (terminal-based Wireshark), dumpcap, rawshark, tcpdump.
   2. editcap, mergecap, capinfos, text2pcap.

Advanced Topics

1. Advanced filters and grouped I/O statistics.
2. Summary and Q&A.