Complete Wireshark Course From Level 0 To Advanced For 2026

Learn how Wireshark, a free and open source packet sniffer, captures and filters network traffic for offline analysis, troubleshooting, and validating security and protocol implementations.

Learn to install Wireshark on Windows, Mac, and Linux using proper installers, portable options, and arm-based downloads, then verify the installation and understand Tshark and Npcap roles.

Explore the Open Systems Interconnection (OSI) model and its seven layers, the foundation for understanding how data travels from sender to receiver across networks, and how to troubleshoot network issues.

Explore how the application layer of the OSI model provides http, https, smtp, ftp, sip, ssh protocols that enable network applications like browsers, emails, and video calls to function.

Understand how the presentation layer translates raw application data into binary, handles encoding conversions, and applies encryption and compression to enable secure, efficient TLS-protected transmission.

The session layer manages device communication, authentication, authorization, and checkpoints, assigning unique session IDs and enabling restoration to resume data exchange after interruptions.

Break down transport layer, detailing segmentation, process-to-process delivery with port numbers, flow control via window size, checksum-based error checking, and the choice between TCP's reliable delivery and UDP's unreliable delivery.

Deliver segments from the transport layer as packets to the destination host; assign source and destination IP addresses; and route data through routers, using fragmentation to fit MTU limits.

Explore the data link layer's node-to-node data delivery, flow and error control, and framing, physical addressing with mac addresses, and media access control for collision avoidance.

Understand how the physical layer converts digital data into electrical, optical, or radio signals for transmission over cables and wifi. Hubs and switches, and MAC addresses are data link concepts.

Explore encapsulation across the transport, network, and data link layers, where headers and trailers are added to form packets, then decapsulation at the destination opens data for the receiver's application.

Learn the TCP/IP model, named for the TCP and IP protocols, enabling internet communication and highlighting OSI as the prerequisite.

Compare old and updated tcp/ip models, highlighting the five-layer design, renamed network layer, data link and physical layer split, and OSI-aligned structure with first layers merged into application.

Explore why TCP/IP was implemented over the OSI model, highlighting its four-layer, practical design, use of existing protocols, and rapid adoption in the 1970s–80s.

Recognize the OSI model's seven layers as a detailed framework for understanding data communication and troubleshooting, even as TCP/IP merges layers into the application layer.

Explore the tcp/ip model, compare its layers to the osi model, and learn how application, transport, network, data link, and physical layers handle data as bits, segments, packets, and frames.

Explore the fundamentals of wireless security by understanding WLAN, Wi-Fi concepts, and the 802.11 standard, including how wireless connectivity enables devices to access networks and the internet.

Master the main Wireshark toolbar by learning how to start and stop captures, save and reload files, configure capture options, and navigate packets with go to, arrows, and auto scroll.

Learn how Wireshark columns work, customize them with new fields like source and destination mac addresses, adjust time formats, and apply as columns for tailored packet views.

Explore promiscuous mode versus monitor mode, how to enable or disable promiscuous mode in capture options, and how each mode captures traffic on network interfaces.

Apply Wireshark filters to isolate AP traffic by using display filters on captured data and capture filters before capturing, with insights into more than 50 filters.

Learn to write and apply basic filters in Wireshark, filter traffic by protocol from the filter bar, and display tcp, udp, dns, arp, icmp, tls, and https traffic.

Discover how to optimize Wireshark filters using or and not operators, pipes, and bracketed expressions to selectively display or exclude traffic such as HTTP, ARP, ICMP, UDP, and TCP.

Apply ip header filters to reveal packets for specified ip addresses, using or and and operators, then refine by ip source or destination and protocol such as udp or tcp.

learn to filter traffic in wireshark by port numbers, using tcp and udp filters, combine multiple ports, and inspect packets delivered to or originating from specific ports.

Filter traffic by mac address in Wireshark using the ethernet address, combine multiple addresses with the and operator, and view packets sent or received by that address.

Master the in operator, a membership operator, to filter packets by multiple IP addresses, ports, or MAC addresses inside curly brackets, separated by commas, for compact, readable queries.

Explore the contains and matches operators to filter packets by words or phrases in Wireshark. Compare matches to contains, search multiple phrases with pipe, and use Perl-based regex across protocols.

Learn to write and apply basic capture filters for specific interfaces, capture TCP or UDP traffic, and combine filters with or and not in the capture options and bookmarks.

Capture application layer traffic with port-based filters in Wireshark, targeting http, https, ftp, and dns, and learn to combine filters. If a protocol name fails, use its port number.

Learn to capture traffic by IP address with host filters, combining IPv4 and IPv6 addresses using and/or operators, and filtering by source, destination, port, and even domain names.

Capture traffic by a mac address using the ether host filter and start capturing only frames from that address, then refine with ether src or ether dst and logical operators.

Learn to use port and port range filters in Wireshark to capture specific traffic, switching between TCP and UDP, and combining ranges to target HTTP and HTTPS communications.

Learn to create, save, and reuse capture filters in Wireshark. Manage filters with the plus button, name expressions, and apply them with a single click.

Learn to create, configure, and switch between Wireshark profiles to optimize capture and analysis tasks. Export, import, and customize profiles for task-specific layouts and fields.

Learn how to export and save specific packets from unsaved and saved Wireshark files by applying display filters, saving only filtered or manually selected packets, or using a range.

Learn to automatically split captures into multiple files and to stop capturing based on packet count, file count, size, or time thresholds.

Merge multiple pcap files into one using two methods: merge options (beginning, chronologically, or append) with saving; or drag and drop from a directory and save the merged file.

Learn to customize Wireshark filters with coloring rules, add and edit filters such as an FTP filter, and enable name resolution to convert IP addresses to domain names or hosts.

Discover how Nmap maps networks, scans open ports and services, and reveals vulnerabilities that hackers might exploit, helping network and system administrators.

Install and set up nmap on windows and linux, including xenmap gui, then run scans by selecting scan types and verifying with the command prompt.

Learn basic nmap commands, check host availability with a ping scan, and perform a top 1000 port scan across single or multiple hosts, identifying open, closed, and filtered ports.

Learn the three port states open, filtered, and closed, and how open ports enable hacker access via port 21 (ftp) and port 22 (ssh), with rapid and default nmap scans.

Discover how to scan specific ports and ranges with and map using the -p flag. Scan single ports, comma-separated lists, and port ranges, or use service names like ftp.

Identify the OS, running services, and their versions on the target network to assess vulnerabilities and guide patching.

Execute an aggressive Nmap scan to detect services, versions, and operating systems, plus traceroute and key details like SSH keys and Apache version.

Save nmap scan results to a file using output redirection or the -o option, in txt or xml formats; xml supports sharing with other applications.