TCP/IP Network Traffic Analysis with Wireshark Training Course

Network Analysis Overview

1. Essentials of the OSI reference model and TCP/IP networks.
2. Overview of troubleshooting tools and methodologies.
3. Introduction to Wireshark.
4. Understanding Wireshark: Portable version features and available resources.
5. Wireshark GUI layout: Panes (Packet List, Details, Packet Bytes), Status Bar, and more.
6. Internal architecture and processing flow; limitations of what cannot be observed.
7. Supported protocols and dissectors.
8. Managing preferences and configurations, both global and profile-specific.
9. Interpreting time values.
10. Lab exercises.

Capturing Traffic

1. Key considerations before initiating a capture.
2. Understanding Promiscuous mode.
3. Applying capture filters.
4. Setting automatic stop criteria.
5. Performing remote captures.
6. Lab exercises.

Traffic Analysis: Tools and Approaches

1. Establishing an analysis checklist.
2. Utilizing features: name resolution, colorization, marking, ignoring, commenting, time references, and time shifts.
3. Understanding the Expert System.
4. Accessing options via Right-Click functionality.
5. Interpreting reference patterns and assessing the impact of OS/driver Offload features.
6. Preserving analysis results.
7. Lab exercises and case studies.

Traffic Analysis: Tools and Approaches (Continued)

1. Filtering traffic: Display filters (preparing "in-flight" filters, using macros) and following data streams.
2. Quantitative analysis.
   1. Reviewing basic predefined descriptive statistics and summaries: Capture Properties, Protocol Hierarchy, Conversations, Endpoints, Packet Lengths, and IP-specific data.
   2. Protocol-specific analysis (e.g., TCP Stream Graphs).
   3. Performing advanced custom statistics using I/O Graphs.
   4. Visualizing data flows.

Traffic Analysis: Protocols

1. Data-Link Layer: Ethernet II.
2. Network Layer: IPv4.
3. Transport Layer: TCP and UDP.
   1. Packet loss and recovery mechanisms.
   2. Events involving lost previous segments and Out-of-Order Segments.
   3. Duplicate ACKs and Fast Retransmissions.
   4. TCP Retransmissions.
   5. Zero Window, window size changes, and other window-related issues.
4. Application Layer: HTTP and FTP.
5. Lab exercises and case studies.

Traffic Analysis: Common Issues in Network Performance Assessment

1. Identifying the root causes of performance problems.
2. Analyzing packet loss.
3. Addressing bandwidth issues using a layered measurement approach.
4. Evaluating latency: assessing end-to-end delays and visualization techniques.
5. Lab exercises.
6. (Wireshark) command-line tools:
   1. tshark (terminal-based Wireshark), dumpcap, rawshark, and tcpdump
   2. editcap, mergecap, capinfos, and text2pcap

Advanced Topics

1. Advanced filters and grouped I/O statistics.
2. Course summary and Q&A session.