TCP/IP Network Traffic Analysis with Wireshark Training Course

Day 1

Overview of Network Analysis

1. Essentials of the OSI Reference Model and TCP/IP networks.
2. Troubleshooting tools and methodologies.
3. Introduction to Wireshark
4. What is Wireshark? Portable Wireshark. Resources.
5. Structure of the Wireshark GUI: Panes (Packet List, Details, Packet Bytes), Status Bar, etc.
6. Architecture and processing flow. Limitations of what Wireshark can and cannot capture.
7. Supported protocols and dissectors.
8. Preferences and configurations: global and profile-specific settings.
9. Time values and references.
10. Lab exercises.

Day 2

Capturing Traffic

1. Key considerations before beginning a capture.
2. Promiscuous mode.
3. Capture filters.
4. Automatic stop criteria.
5. Remote capture techniques.
6. Lab exercises.

Traffic Analysis: Tools and Approaches

1. Analysis checklist.
2. Utilizing features such as name resolution, colorization, marking, ignoring, commenting, time references, and time shifts.
3. Understanding the Expert System.
4. Accessing options via right-click functionality.
5. Interpretation of reference patterns and the impact of OS/driver Offload features.
6. Saving results.
7. Lab exercises and case studies.

Day 3

Traffic Analysis: Tools and Approaches (Continued)

1. Filtering traffic: Display filters (preparing 'in-flight' filters, macros), following streams.
2. Quantitative analysis.
   1. Basic predefined descriptive statistics and summaries: Capture Properties, Protocol Hierarchy, Conversations, Endpoints, Packet Lengths, IP-specific metrics.
   2. Protocol-specific analysis (e.g., TCP Stream Graphs).
   3. Advanced custom statistics using I/O Graph.
   4. Flow visualization.

Day 4

Traffic Analysis: Protocols

1. Data-Link Layer: Ethernet II.
2. Network Layer: IPv4.
3. Transport Layer: TCP, UDP.
   1. Packet loss and recovery mechanisms.
   2. Events involving previously lost segments and out-of-order segments.
   3. Duplicate ACKs and Fast Retransmissions.
   4. TCP Retransmissions.
   5. Zero Window, Window changes, and other window-related issues.
4. Application Layer: HTTP, FTP.
5. Lab exercises and case studies.

Day 5

Traffic Analysis: Common Issues in Network Performance Assessment

1. Causes of performance problems.
2. Packet loss.
3. Bandwidth issues. A layered approach to measurement.
4. Latency: assessing end-to-end latency and visualization.
5. Lab exercises.
6. (Wireshark) command-line tools:
   1. tshark (terminal-based Wireshark), dumpcap, rawshark, tcpdump
   2. editcap, mergecap, capinfos, text2pcap.

Advanced Topics

1. Advanced filters, grouped I/O statistics.
2. Summary and Q&A.