Course Outline
Network analysis overview
- OSI reference model and TCP/IP networks essentials.
- Troubleshooting tools and methodologies.
- Introduction to Wireshark
- What is Wireshark? Portable Wireshark. Resources.
- Wireshark GUI structure: Panes (Packet List, Details, Packet Bytes), Status Bar, ... .
- Architecture and processing flow. What cannot be seen with Wireshark and why?
- Supported protocols. Dissectors.
- Preferences and configurations; global and profile specific.
- Time values.
- Lab exercises.
Capture traffic
- Key considerations before starting.
- Promiscuous mode.
- Capture filters.
- Automatic stop criteria.
- Remote capture.
- Lab exercises.
Traffic analysis: tools and approaches
- Analysis checklist.
- Utilizing features: name resolution, colorization, marking, ignoring, commenting, time references, time shifts, etc.
- Understanding the Expert System.
- Navigating options via Right-Click functionality.
- Interpretation (reference patterns), impact of OS/driver Offload features.
- Saving results.
- Lab exercises and case studies.
Traffic analysis: tools and approaches (cont.)
- Filtering traffic: Display filters (preparing "in-flight" filters, macros), following streams.
- Quantitative analysis.
- Basic predefined descriptive statistics and summaries: Capture Properties, Protocol Hierarchy, Conversations, Endpoints, Packet Lengths, IP-specific.
- Protocol-specific analysis (e.g., TCP Stream Graphs).
- Advanced custom statistics using I/O Graph.
- Flow visualization.
Traffic analysis: protocols
- Data-Link Layer: Ethernet II.
- Network Layer: IPv4.
- Transport Layer: TCP, UDP.
- Packet loss and recovery.
- Previous segment lost and Out-of-Order Segments events.
- Duplicate ACKs and Fast Retransmissions.
- TCP Retransmissions.
- Zero Window, Window changes, and other window-related issues.
- Application layer: HTTP, FTP.
- Lab exercises and case studies.
Traffic analysis: common issues in network performance assessment
- Causes of performance problems.
- Packet loss.
- Bandwidth issues. Layered approach to measurement.
- Latency: assessing end-to-end latency, visualization.
- Lab exercises.
- (Wireshark) command-line tools:
- tshark (terminal-based Wireshark) / dumpcap / rawshark, tcpdump
- editcap, mergecap, capinfos, text2pcap.
Advanced topics
- Advanced filters, grouped iostats.
- Summary and Q&A.
Requirements
1. Familiarity with the ISO OSI Reference Model - ITU-T X.200 and the TCP/IP protocol stack.
2. Basic knowledge of Unix/Linux OS: UNIX terminal, directory structure, listing files and directories, creating directories, navigating directories, copying, moving and removing files and directories, redirection, pipes, processes - listing suspended and background processes.
Hardware & Software
1. HW: Minimum 16GB of RAM and at least 60GB of free disk space.
2. OS: Ubuntu Linux OS is preferred. The following applications should be installed: ip,
iperf, ipcalc.
3. SW: Wireshark application (https://www.wireshark.org/download.html).
All components should be running the latest stable available releases.
Custom Corporate Training
Training solutions designed exclusively for businesses.
- Customized Content: We adapt the syllabus and practical exercises to the real goals and needs of your project.
- Flexible Schedule: Dates and times adapted to your team's agenda.
- Format: Online (live), In-company (at your offices), or Hybrid.
Price per private group, online live training, starting from 8000 € + VAT*
Contact us for an exact quote and to hear our latest promotions
Testimonials (3)
practical case studies
Kamil - P4 Sp. z o.o.
Course - Basic Network Troubleshooting Using Wireshark
knowledge of the instructor
Grzegorz - Centrum Informatyki Resortu Finansow
Course - Network Troubleshooting with Wireshark
Many exercises, good knowladge
