Threat Hunting with Wireshark: Network Forensics

Turn suspicious network traffic into a clear, defensible investigation.

Threat Hunting with Wireshark takes you beyond finding an unusual packet. Learn to frame a useful question, assess the evidence, reconstruct activity, test competing explanations and communicate what the traffic actually supports.

Across 24 stages, you will progress from a reliable analysis workspace to complex investigations involving command-and-control, lateral movement, possible data loss and incident response. Wireshark is the primary analysis tool, supported by TShark and capture utilities for repeatable offline work.

Start with the foundations that make an investigation trustworthy: capture preservation, timestamps, visibility limits, precise display filters and a reusable analyst profile. Learn to reconstruct TCP and UDP conversations, establish a baseline and use endpoints, conversations, protocol hierarchy and I/O graphs to prioritize leads.

Then explore the patterns that matter in security investigations. Analyze suspicious DNS activity, web delivery clues, scanning and authentication-related signals. Examine beacon-like behaviour and distinguish suspicious callbacks from legitimate periodic traffic. Investigate TLS and QUIC metadata while recognizing what encryption prevents you from seeing.

Later stages cover DNS tunneling candidates, multi-protocol command-and-control, SMB and remote-service activity, potential exfiltration and multi-stage intrusion timelines. You will learn to separate observed wire volume from confirmed data exposure and use supporting host or identity evidence where packets alone cannot answer the question.

The final stages connect analysis to action: incident scoping, evidence registers, technical reporting, executive summaries, reusable hunt playbooks and testable detection proposals. The capstone brings these methods together in a complete investigation workflow.

By the end of the course, you will be able to:

• Form a testable hunt hypothesis with a clear scope and stop condition.

• Assess capture quality and explain collection blind spots.

• Build precise filters and repeatable Wireshark and TShark workflows.

• Reconstruct network activity and evaluate plausible benign explanations.

• Investigate command-and-control, internal movement and potential exfiltration.

• Produce reproducible findings, clear timelines and decision-focused reports.

This course is designed for SOC analysts, security engineers, incident responders and practitioners moving into network forensics. It starts at an intermediate level and progresses toward advanced investigation work. Bring a working knowledge of TCP/IP, DNS, HTTP and TLS, along with basic Wireshark navigation. Familiarity with terminal commands and CSV files will help; programming is not required.

Use the techniques with captures you are authorized to analyze. The focus throughout is disciplined reasoning: distinguish facts from assumptions, record uncertainty and make every conclusion traceable to evidence.