TCP/IP Network Traffic Analysis with Wireshark Training Course

Day 1

Overview of Network Analysis for Government

1. Essentials of the OSI reference model and TCP/IP networks.
2. Troubleshooting methodologies and tools for government.
3. Introduction to Wireshark for government.
4. Understanding Wireshark: portable versions, resources, and key features.
5. Wireshark GUI structure: Packet List, Details, Packet Bytes panes, Status Bar, and more.
6. Architecture and processing flow of Wireshark. Limitations on what can be seen with Wireshark for government.
7. Supported protocols and dissectors in Wireshark for government.
8. Configuring preferences and settings: global and profile-specific configurations.
9. Managing time values in Wireshark for government.
10. Hands-on lab exercises.

Day 2

Capturing Traffic for Government

1. Pre-capture considerations for government networks.
2. Utilizing promiscuous mode in network capture for government.
3. Applying capture filters for targeted data collection for government.
4. Setting automatic stop criteria for efficient data management for government.
5. Conducting remote captures for government networks.
6. Hands-on lab exercises.

Traffic Analysis: Tools and Approaches for Government

1. Developing a traffic analysis checklist for government.
2. Utilizing Wireshark features: name resolution, colorization, marking, ignoring, commenting, time references, and time shifts.
3. Understanding the Expert System in Wireshark for government.
4. Accessing options through right-click functionality for efficient analysis for government.
5. Interpreting results with reference patterns and understanding OS/driver offload features for government.
6. Saving and documenting analysis results for government.
7. Hands-on lab exercises and case studies for government.

Day 3

Traffic Analysis: Tools and Approaches (Continued) for Government

1. Filtering traffic in Wireshark for government:
   • Using display filters, preparing "in-flight" filters, and macros.
   • Following network streams for detailed analysis for government.
2. Quantitative Analysis in Wireshark for government:
   1. Basic predefined descriptive statistics and summaries: Capture Properties, Protocol Hierarchy, Conversations, Endpoints, Packet Lengths, and IP-specific analysis.
   2. Protocol-specific analysis, such as TCP Stream Graphs for government.
   3. Advanced custom statistics with I/O Graph for government.
   4. Flow visualization techniques for government.

Day 4

Traffic Analysis: Protocols for Government

1. Data-Link Layer analysis: Ethernet II for government.
2. Network Layer analysis: IPv4 for government.
3. Transport Layer analysis for government:
   1. Identifying and resolving packet loss and recovery issues for government.
   2. Analyzing previous segment lost and out-of-order segments events for government.
   3. Understanding duplicate ACKs and fast retransmissions for government.
   4. Investigating TCP retransmissions for government.
   5. Addressing zero window, window changes, and other window problems for government.
4. Application Layer analysis: HTTP and FTP for government.
5. Hands-on lab exercises and case studies for government.

Day 5

Traffic Analysis: Common Issues in Network Performance Assessment for Government

1. Identifying causes of performance problems in government networks.
2. Analyzing packet loss for government.
3. Addressing bandwidth issues with a layered approach to measurement for government.
4. Assessing and visualizing end-to-end latency for government.
5. Hands-on lab exercises for government.
6. Command-line tools in Wireshark for government:
   1. Using tshark, dumpcap, rawshark, and tcpdump for command-line analysis for government.
   2. Utilizing editcap, mergecap, capinfos, and text2pcap for advanced data manipulation for government.

Advanced Topics in Network Analysis for Government

1. Developing advanced filters and grouped I/O statistics for government.
2. Summary and Q&A session for government.