TCP/IP Network Traffic Analysis with Wireshark Training Course

Overview of Network Analysis

1. Essential concepts regarding the OSI reference model and TCP/IP networking architectures.
2. Methodologies and utilities utilized for network troubleshooting.
3. Foundational introduction to Wireshark capabilities.
4. Definition of Wireshark; deployment via portable versions; access to supplemental resources for government analysts.
5. Structure of the Wireshark graphical user interface: Packet List pane, Details pane, Packet Bytes pane, and Status Bar.
6. System architecture and packet processing workflows. Limitations regarding observability within Wireshark.
7. Supported network protocols and dissector mechanisms.
8. Application of global and profile-specific preferences and configurations.
9. Interpretation of time values in capture data.
10. Practical laboratory exercises.

Traffic Capture Procedures

1. Pre-capture considerations and prerequisites.
2. Configuration of promiscuous mode for comprehensive packet acquisition.
3. Implementation of capture filters.
4. Definition of automatic stop criteria.
5. Procedures for remote capture operations.
6. Practical laboratory exercises.

Traffic Analysis: Tools and Approaches

1. Standard analysis checklist.
2. Utilization of analytical features: name resolution, color coding, packet marking, filtering by exclusion, commenting, time references, and time shifting.
3. Understanding the function and output of the Expert System.
4. Navigating configuration options via right-click contextual menus.
5. Data interpretation using reference patterns; assessment of impacts from OS/driver offloading features.
6. Procedures for saving analysis results.
7. Practical laboratory exercises and case study reviews.

Traffic Analysis: Tools and Approaches (Continued)

1. Traffic filtering techniques: creation of display filters (including macros) and stream following.
2. Quantitative analysis methods.
   1. Descriptive statistics and summaries: Capture Properties, Protocol Hierarchy, Conversations, Endpoints, Packet Lengths, and IP-specific metrics.
   2. Protocol-specific analysis, such as TCP Stream Graphs.
   3. Advanced custom statistics utilizing the I/O Graph tool.
   4. Data flow visualization techniques.

Traffic Analysis: Protocol Examination

1. Data-Link Layer: Ethernet II frame analysis.
2. Network Layer: IPv4 header inspection.
3. Transport Layer: TCP and UDP protocol examination.
   1. Evaluation of packet loss and recovery mechanisms.
   2. Detection of lost previous segments and out-of-order segment events.
   3. Analysis of duplicate acknowledgments and fast retransmission triggers.
   4. Assessment of TCP retransmission issues.
   5. Identification of zero window conditions, window size changes, and related flow control problems.
4. Application Layer: HTTP and FTP protocol analysis.
5. Practical laboratory exercises and case study reviews.

Traffic Analysis: Common Network Performance Issues

1. Identification of root causes for performance degradation.
2. Assessment of packet loss.
3. Evaluation of bandwidth constraints using a layered measurement approach.
4. Latency analysis: end-to-end latency assessment and visualization.
5. Practical laboratory exercises.
6. Command-line utilities (Wireshark toolkit):
   1. tshark (terminal-based capture), dumpcap, rawshark, and tcpdump.
   2. Editcap, mergecap, capinfos, and text2pcap for file manipulation and information retrieval.

Advanced Topics

1. Complex filtering techniques and grouped I/O statistics.
2. Course summary and question-and-answer session.