TCP/IP Network Traffic Analysis with Wireshark Training Course

Overview of Network Analysis

1. Fundamentals of the OSI reference model and TCP/IP networking.
2. Essential troubleshooting tools and methodologies.
3. Introduction to the Wireshark platform.
4. Understanding Wireshark: Portable versions and available resources.
5. Anatomy of the Wireshark GUI: Packet List, Details, Packet Bytes panes, and the Status Bar.
6. Internal architecture and data processing flow; limitations of what Wireshark can visualize.
7. Overview of supported protocols and dissectors.
8. Managing preferences and configurations, including global and profile-specific settings.
9. Interpreting time values within captures.
10. Practical lab exercises.

Traffic Capture

1. Pre-capture considerations and best practices.
2. Utilizing Promiscuous mode.
3. Applying capture filters for targeted data collection.
4. Defining automatic stop criteria.
5. Performing remote captures.
6. Hands-on lab exercises.

Traffic Analysis: Tools and Methodologies

1. Establishing a comprehensive analysis checklist.
2. Leveraging analytical features: name resolution, color coding, packet marking, ignoring, commenting, and time shift utilities.
3. Mastering the Expert Information system.
4. Utilizing context-sensitive options via Right-Click menus.
5. Interpreting data patterns and understanding the impact of OS/driver Offload features.
6. Exporting and saving analysis results.
7. Case studies and practical lab exercises.

Traffic Analysis: Advanced Tools and Approaches

1. Refining traffic views: Creating and preparing Display filters (including "in-flight" filters and macros) and following streams.
2. Conducting quantitative analysis.
   1. Reviewing predefined statistics: Capture Properties, Protocol Hierarchy, Conversations, Endpoints, and packet length distributions.
   2. Protocol-specific deep dives (e.g., TCP Stream Graphs).
   3. Generating advanced custom statistics using I/O Graphs.
   4. Visualizing network flows.

Traffic Analysis: Protocol Deep Dives

1. Data-Link Layer: Analysis of Ethernet II frames.
2. Network Layer: Inspection of IPv4 packets.
3. Transport Layer: In-depth look at TCP and UDP.
   1. Diagnosing packet loss and recovery mechanisms.
   2. Identifying Previous Segment Lost and Out-of-Order Segments events.
   3. Understanding Duplicate ACKs and Fast Retransmissions.
   4. Analyzing TCP Retransmissions.
   5. Resolving Zero Window, Window size changes, and related flow control issues.
4. Application Layer: Examination of HTTP and FTP traffic.
5. Applied lab exercises and case studies.

Addressing Common Network Performance Issues

1. Identifying root causes of performance degradation.
2. Analyzing packet loss patterns.
3. Assessing bandwidth constraints using a layered measurement approach.
4. Evaluating end-to-end latency and visualizing delay impacts.
5. Practical lab exercises.
6. Leveraging (Wireshark) command-line utilities:
   1. tshark (terminal-based Wireshark), dumpcap, rawshark, and tcpdump.
   2. Packet manipulation tools: editcap, mergecap, capinfos, and text2pcap.

Advanced Topics

1. Constructing advanced filters and analyzing grouped I/O statistics.
2. Course summary and Q&A session.