TCP/IP Network Traffic Analysis with Wireshark Training Course

Network analysis overview

1. Overview of the OSI reference model and core TCP/IP network concepts.
2. Methodologies and essential tools for network troubleshooting.
3. Introduction to the Wireshark platform.
4. Definition of Wireshark, portable installation options, and supplementary resources.
5. Structure of the Wireshark graphical user interface: Packet List, Details, and Bytes panes, along with the status bar.
6. System architecture and data processing flow; identification of limitations in visibility.
7. Supported protocols and the role of dissectors in analysis.
8. Configuration management, including global settings and profile-specific parameters.
9. Interpretation of time values in network captures.
10. Practical lab exercises for government application.

Traffic capture procedures

1. Pre-capture planning and strategic considerations.
2. Implementation of promiscuous mode for comprehensive data collection.
3. Application of capture filters to define data scope.
4. Configuration of automatic stop criteria for capture sessions.
5. Procedures for remote traffic capture in distributed environments.
6. Practical lab exercises to reinforce capture standards.

Traffic analysis: tools and approaches

1. Establishment of a systematic analysis checklist.
2. Utilization of built-in features such as name resolution, color coding, packet marking, exclusion rules, commentary, and time-reference adjustments.
3. Understanding and applying the Expert System for error detection.
4. Accessing context-sensitive options via right-click functionality.
5. Data interpretation based on reference patterns, including the impact of OS and driver offload features.
6. Procedures for archiving analysis results.
7. Case studies and lab exercises for operational proficiency.

Traffic analysis: tools and approaches (continued)

1. Traffic filtering techniques: Display filters (including “in-flight” filter preparation and macros) and stream tracing.
2. Quantitative analysis methodologies.
   1. Application of predefined descriptive statistics and summaries, including Capture Properties, Protocol Hierarchy, Conversations, Endpoints, Packet Lengths, and IP-specific metrics.
   2. Protocol-specific analysis techniques, such as TCP Stream Graphs.
   3. Advanced custom statistical modeling using I/O Graphs.
   4. Visualization of network flows for clarity and insight.

Traffic analysis: protocol deep-dive

1. Data-Link Layer analysis: Ethernet II standards.
2. Network Layer analysis: IPv4 mechanisms.
3. Transport Layer analysis: TCP and UDP protocols.
   1. Diagnosis of packet loss and recovery processes.
   2. Identification of Previous Segment Lost and Out-of-Order Segment events.
   3. Analysis of Duplicate ACKs and Fast Retransmissions.
   4. Evaluation of TCP Retransmissions.
   5. Investigation of Zero Window, window size changes, and related flow control issues.
4. Application Layer analysis: HTTP and FTP protocols.
5. Practical lab exercises and case studies for protocol verification.

Traffic analysis: common issues in network performance assessment

1. Root cause identification of performance degradation.
2. Detection and analysis of packet loss incidents.
3. Bandwidth constraint evaluation using a layered measurement approach.
4. Latency assessment, including end-to-end measurement and visualization techniques.
5. Practical lab exercises for performance validation.
6. Utilization of command-line utilities:
   1. Terminal-based tools: tshark, dumpcap, rawshark, and tcpdump.
   2. File management tools: editcap, mergecap, capinfos, and text2pcap.

Advanced topics

1. Construction of advanced filters and grouped I/O statistics.
2. Course summary and questions and answers session.