Complete Wireshark Course From Level 0 to Advanced For 2026

Master the main Wireshark toolbar by learning how to start and stop captures, save and reload files, configure capture options, and navigate packets with go to, arrows, and auto scroll.

Learn how Wireshark columns work, customize them with new fields like source and destination mac addresses, adjust time formats, and apply as columns for tailored packet views.

Explore promiscuous mode versus monitor mode, how to enable or disable promiscuous mode in capture options, and how each mode captures traffic on network interfaces.

Apply Wireshark filters to isolate AP traffic by using display filters on captured data and capture filters before capturing, with insights into more than 50 filters.

Learn to write and apply basic filters in Wireshark, filter traffic by protocol from the filter bar, and display tcp, udp, dns, arp, icmp, tls, and https traffic.

learn to filter traffic in wireshark by port numbers, using tcp and udp filters, combine multiple ports, and inspect packets delivered to or originating from specific ports.

Explore the contains and matches operators to filter packets by words or phrases in Wireshark. Compare matches to contains, search multiple phrases with pipe, and use Perl-based regex across protocols.

Learn to write and apply basic capture filters for specific interfaces, capture TCP or UDP traffic, and combine filters with or and not in the capture options and bookmarks.

Capture application layer traffic with port-based filters in Wireshark, targeting http, https, ftp, and dns, and learn to combine filters. If a protocol name fails, use its port number.

Learn to use port and port range filters in Wireshark to capture specific traffic, switching between TCP and UDP, and combining ranges to target HTTP and HTTPS communications.

Learn to create, configure, and switch between Wireshark profiles to optimize capture and analysis tasks. Export, import, and customize profiles for task-specific layouts and fields.

Learn how to export and save specific packets from unsaved and saved Wireshark files by applying display filters, saving only filtered or manually selected packets, or using a range.

Identify the OS, running services, and their versions on the target network to assess vulnerabilities and guide patching.

Save nmap scan results to a file using output redirection or the -o option, in txt or xml formats; xml supports sharing with other applications.

Explore the data link layer's node-to-node data delivery, flow and error control, and framing, physical addressing with mac addresses, and media access control for collision avoidance.

Compare old and updated tcp/ip models, highlighting the five-layer design, renamed network layer, data link and physical layer split, and OSI-aligned structure with first layers merged into application.

Recognize the OSI model's seven layers as a detailed framework for understanding data communication and troubleshooting, even as TCP/IP merges layers into the application layer.

Explore the tcp/ip model, compare its layers to the osi model, and learn how application, transport, network, data link, and physical layers handle data as bits, segments, packets, and frames.

Learn how TCP sequence and acknowledgement numbers coordinate reliable data delivery, compute segment data vs header lengths, and follow the next expected sequence in a three-way handshake.

Understand how window size (TCP receive window) and window scaling extend TCP throughput by negotiating scaling during the three-way handshake; interpret how unacknowledged data and receive buffers influence flow control.

Explore how the maximum segment size (MSS) determines the payload per TCP segment, its relation to MTU and headers, and how Wireshark reveals MSS during the TCP three-way handshake.