TCP/IP Network Traffic Analysis with Wireshark Training Course

Network Analysis Fundamentals

1. Core concepts of the OSI reference model and TCP/IP networking.
2. Overview of troubleshooting tools and systematic methodologies.
3. Introduction to Wireshark capabilities
4. Understanding Wireshark: Portable versions and available resources.
5. Interface layout: Packet List, Details, Packet Bytes panes, and Status Bar.
6. Architecture and data processing flow, including visibility limitations.
7. Overview of supported protocols and dissectors.
8. Configuring preferences, including global and profile-specific settings.
9. Interpreting time values within captures.
10. Practical laboratory exercises.

Traffic Capture Techniques

1. Key considerations prior to initiating a capture session.
2. Understanding and utilizing Promiscuous mode.
3. Applying capture filters to optimize data collection.
4. Setting automatic stop conditions for captures.
5. Performing remote packet captures.
6. Practical laboratory exercises.

Traffic Analysis: Tools and Methodologies

1. Developing a structured analysis checklist.
2. Leveraging analysis features: name resolution, colorization, marking, ignoring, commenting, and time reference tools.
3. Interpreting the Expert Information system.
4. Utilizing context menu options via right-click functionality.
5. Analyzing reference patterns and assessing the impact of OS/driver Offload features.
6. Exporting and saving analysis results.
7. Lab exercises and real-world case studies.

Traffic Analysis: Tools and Methodologies (Continued)

1. Refining traffic visibility: Display filters (creating "in-flight" filters, using macros), and following data streams.
2. Quantitative data analysis.
   1. Reviewing predefined statistics and summaries: Capture Properties, Protocol Hierarchy, Conversations, Endpoints, Packet Lengths, and IP-specific metrics.
   2. Conducting protocol-specific analysis (e.g., TCP Stream Graphs).
   3. Utilizing I/O Graphs for advanced custom statistics.
   4. Visualizing network flows.

Traffic Analysis: Protocol Deep Dive

1. Data-Link Layer: Focusing on Ethernet II.
2. Network Layer: Analyzing IPv4.
3. Transport Layer: Examining TCP and UDP behaviors.
   1. Monitoring packet loss and recovery mechanisms.
   2. Identifying Previous Segment Lost and Out-of-Order Segments events.
   3. Diagnosing Duplicate ACKs and Fast Retransmissions.
   4. Analyzing TCP Retransmissions.
   5. Investigating Zero Window conditions, window adjustments, and related flow control issues.
4. Application Layer: Inspecting HTTP and FTP traffic.
5. Lab exercises and case study applications.

Traffic Analysis: Addressing Common Performance Issues

1. Identifying root causes of performance degradation.
2. Analyzing packet loss impacts.
3. Addressing bandwidth constraints using a layered measurement approach.
4. Measuring and visualizing end-to-end latency.
5. Practical laboratory exercises.
6. Utilizing (Wireshark) command-line utilities:
   1. tshark (terminal-based Wireshark), dumpcap, rawshark, and tcpdump
   2. editcap, mergecap, capinfos, and text2pcap.

Advanced Concepts

1. Applying advanced filters and grouped I/O statistics.
2. Course summary and Q&A session.