Complete Wireshark Course From Level 0 to Advanced For 2026

Learn how Wireshark, a free and open source packet sniffer, captures and filters network traffic for offline analysis, troubleshooting, and validating security and protocol implementations.

Master the main Wireshark toolbar by learning how to start and stop captures, save and reload files, configure capture options, and navigate packets with go to, arrows, and auto scroll.

Learn how Wireshark columns work, customize them with new fields like source and destination mac addresses, adjust time formats, and apply as columns for tailored packet views.

Explore promiscuous mode versus monitor mode, how to enable or disable promiscuous mode in capture options, and how each mode captures traffic on network interfaces.

Apply Wireshark filters to isolate AP traffic by using display filters on captured data and capture filters before capturing, with insights into more than 50 filters.

Learn to write and apply basic filters in Wireshark, filter traffic by protocol from the filter bar, and display tcp, udp, dns, arp, icmp, tls, and https traffic.

learn to filter traffic in wireshark by port numbers, using tcp and udp filters, combine multiple ports, and inspect packets delivered to or originating from specific ports.

Master the in operator, a membership operator, to filter packets by multiple IP addresses, ports, or MAC addresses inside curly brackets, separated by commas, for compact, readable queries.

Explore the contains and matches operators to filter packets by words or phrases in Wireshark. Compare matches to contains, search multiple phrases with pipe, and use Perl-based regex across protocols.

Learn to write and apply basic capture filters for specific interfaces, capture TCP or UDP traffic, and combine filters with or and not in the capture options and bookmarks.

Capture application layer traffic with port-based filters in Wireshark, targeting http, https, ftp, and dns, and learn to combine filters. If a protocol name fails, use its port number.

Learn to use port and port range filters in Wireshark to capture specific traffic, switching between TCP and UDP, and combining ranges to target HTTP and HTTPS communications.

Learn to create, configure, and switch between Wireshark profiles to optimize capture and analysis tasks. Export, import, and customize profiles for task-specific layouts and fields.

Learn how to export and save specific packets from unsaved and saved Wireshark files by applying display filters, saving only filtered or manually selected packets, or using a range.

Learn to automatically split captures into multiple files and to stop capturing based on packet count, file count, size, or time thresholds.

Merge multiple pcap files into one using two methods: merge options (beginning, chronologically, or append) with saving; or drag and drop from a directory and save the merged file.

Discover how Nmap maps networks, scans open ports and services, and reveals vulnerabilities that hackers might exploit, helping network and system administrators.

Learn basic nmap commands, check host availability with a ping scan, and perform a top 1000 port scan across single or multiple hosts, identifying open, closed, and filtered ports.

Learn the three port states open, filtered, and closed, and how open ports enable hacker access via port 21 (ftp) and port 22 (ssh), with rapid and default nmap scans.

Identify the OS, running services, and their versions on the target network to assess vulnerabilities and guide patching.

Execute an aggressive Nmap scan to detect services, versions, and operating systems, plus traceroute and key details like SSH keys and Apache version.

Save nmap scan results to a file using output redirection or the -o option, in txt or xml formats; xml supports sharing with other applications.

Explore the Open Systems Interconnection (OSI) model and its seven layers, the foundation for understanding how data travels from sender to receiver across networks, and how to troubleshoot network issues.

Explore how the application layer of the OSI model provides http, https, smtp, ftp, sip, ssh protocols that enable network applications like browsers, emails, and video calls to function.

Deliver segments from the transport layer as packets to the destination host; assign source and destination IP addresses; and route data through routers, using fragmentation to fit MTU limits.

Explore the data link layer's node-to-node data delivery, flow and error control, and framing, physical addressing with mac addresses, and media access control for collision avoidance.

Understand how the physical layer converts digital data into electrical, optical, or radio signals for transmission over cables and wifi. Hubs and switches, and MAC addresses are data link concepts.

Learn the TCP/IP model, named for the TCP and IP protocols, enabling internet communication and highlighting OSI as the prerequisite.

Compare old and updated tcp/ip models, highlighting the five-layer design, renamed network layer, data link and physical layer split, and OSI-aligned structure with first layers merged into application.

Recognize the OSI model's seven layers as a detailed framework for understanding data communication and troubleshooting, even as TCP/IP merges layers into the application layer.

Explore the tcp/ip model, compare its layers to the osi model, and learn how application, transport, network, data link, and physical layers handle data as bits, segments, packets, and frames.

Analyze the three-way handshake in Wireshark by examining client and server packets, syn, syn-ack, and ack, and initial sequence numbers before data transfer.

Learn how TCP sequence and acknowledgement numbers coordinate reliable data delivery, compute segment data vs header lengths, and follow the next expected sequence in a three-way handshake.

Understand how window size (TCP receive window) and window scaling extend TCP throughput by negotiating scaling during the three-way handshake; interpret how unacknowledged data and receive buffers influence flow control.

Explore how the maximum segment size (MSS) determines the payload per TCP segment, its relation to MTU and headers, and how Wireshark reveals MSS during the TCP three-way handshake.