TCP/IP Network Traffic Analysis with Wireshark Training Course

Overview of Network Analysis

1. Essentials of the OSI reference model and TCP/IP networking.
2. Available troubleshooting tools and effective methodologies.
3. Getting started with Wireshark
4. Introduction to Wireshark: Portable version features and available resources.
5. Understanding the Wireshark GUI layout: Panes (Packet List, Details, Packet Bytes), Status Bar, and more.
6. Internal architecture and processing flow; understanding the limitations of what Wireshark can visualize.
7. Overview of supported protocols and dissectors.
8. Configuring preferences: global settings versus profile-specific adjustments.
9. Interpreting time values in captures.
10. Practical lab exercises.

Traffic Capture

1. Key considerations prior to initiating a capture.
2. Understanding Promiscuous mode.
3. Implementing capture filters.
4. Setting automatic stop criteria.
5. Performing remote captures.
6. Hands-on lab exercises.

Traffic Analysis: Tools and Methodologies

1. Developing a comprehensive analysis checklist.
2. Leveraging built-in features: name resolution, colorization, marking, ignoring packets, adding comments, utilizing time references, and applying time shifts.
3. Mastering the Expert Information system.
4. Navigating options via Right-Click functionality.
5. Interpreting data based on reference patterns and assessing the impact of OS/driver Offload features.
6. Exporting and saving analysis results.
7. Lab exercises and case study walkthroughs.

Traffic Analysis: Tools and Methodologies (Continued)

1. Filtering traffic: Utilizing Display filters (including pre-configured "in-flight" filters and macros) and following data streams.
2. Quantitative analysis.
   1. Reviewing basic predefined statistics and summaries: Capture Properties, Protocol Hierarchy, Conversations, Endpoints, Packet Lengths, and IP-specific metrics.
   2. Conducting protocol-specific analysis (e.g., TCP Stream Graphs).
   3. Generating advanced custom statistics using I/O Graphs.
   4. Visualizing data flow.

Traffic Analysis: Protocol Deep Dive

1. Data-Link Layer: Focus on Ethernet II.
2. Network Layer: Focus on IPv4.
3. Transport Layer: In-depth analysis of TCP and UDP.
   1. Diagnosing packet loss and recovery mechanisms.
   2. Analyzing Previous Segment Lost and Out-of-Order Segments events.
   3. Investigating Duplicate ACKs and Fast Retransmissions.
   4. Understanding TCP Retransmissions.
   5. Resolving Zero Window, window scaling changes, and other window-related issues.
4. Application Layer: Analysis of HTTP and FTP.
5. Lab exercises and applied case studies.

Traffic Analysis: Common Challenges in Network Performance Assessment

1. Identifying root causes of performance degradation.
2. Analyzing packet loss patterns.
3. Addressing bandwidth constraints using a layered measurement approach.
4. Evaluating latency: assessing end-to-end delays and visualization techniques.
5. Practical lab exercises.
6. (Wireshark) Command-line utilities:
   1. tshark (terminal-based Wireshark), dumpcap, rawshark, and tcpdump
   2. editcap, mergecap, capinfos, and text2pcap.

Advanced Topics

1. Implementing advanced filters and grouped I/O statistics.
2. Course summary and Q&A session.