
Explore ethical hacking basics and network security concepts, including the OSI and TCP/IP models, to identify vulnerabilities and use Wireshark for network analysis.
Explore the OSI model as a seven-layer framework for network communication. Understand data encapsulation, PDUs, and layer addresses like MAC, IP, and port.
Explore network hardware fundamentals across hubs, switches, and routers, from layer 1 to 3, including half and full duplex, MAC addresses, CAM tables, and routing.
Explore how broadcast, unicast, and multicast traffic move across networks, explain broadcast domains, and show how Mac and IP addresses, routers, and switches control delivery.
Position the packet sniffer in the server room to capture the most traffic across different topologies, then enable promiscuous mode on the NIC for Wireshark to see all packets.
Explore how hubs maximize visibility for packet sniffing with Wireshark by broadcasting traffic to every port. Understand why switches replace hubs to prevent collisions and keep networks fast.
Learn to capture traffic on switched networks with port mirroring, hubs, and network taps, and compare reliability and bandwidth trade-offs for sniffing with Wireshark.
Discover why Wireshark is popular for packet analysis with 1000+ protocols, a free open-source GPL GUI, and beginner-friendly visualization.
Download and install Wireshark on Windows, set up Winpcap and the USB pcap and Npcap drivers, choose default components like Wireshark and Tshark, enable desktop shortcuts, then reboot.
Install and configure Wireshark on Linux, enable non-root capture, add your user to the wireshark group, and explore essential tools like tcpdump, tshark, and nmap for enhanced packet analysis.
Compare external and integrated wifi adapters on Linux for Wireshark packet sniffing, focusing on monitor mode, protocol support, isolation, and terminal network configuration with ip link and nmtui.
Customize Wireshark by adjusting appearance, capture settings, filters, name resolution, coloring rules, and protocol settings, then manage and switch configuration profiles to tailor packet analysis.
Save capture files for later analysis, export specific packets, and merge multiple captures to form a complete view of network activity. Arrange merged data chronologically to support efficient investigations.
Master wireshark filters to find the right packets using display, text, hex, and string searches; learn to mark and print key packets while using time display, referencing, and shifting.
Control Wireshark captures by selecting interfaces, enabling promiscuous mode, adjusting buffer size, and using file sets with ring buffers to manage long captures.
Master capture filters in Wireshark to selectively capture traffic before packet capture, using host, port, and BPF syntax to boost efficiency and focus on relevant packets.
Use display filters in Wireshark to narrow the packet data shown, and apply expressions or the display filter dialog to build precise filters with operators.
Install Tshark and Tcpdump across Windows and Linux to enable lightweight, headless packet capture, then filter live traffic and save captures for later review in Wireshark.
Learn to capture and analyze network traffic with Tshark and tcpdump, from starting captures and selecting interfaces to saving pcap files and interpreting IPs, ports, and protocols.
Learn how the address resolution protocol enables mapping of IP addresses to MAC addresses through ARP requests and responses, enabling switches to deliver data on local networks.
Explore how IPv4 and IPv6 enable inter-network communication, with a focus on IPv4's 32-bit dot code notation, netmasks, CIDR notation, and the header fields that route packets.
Analyze ttl and ip fragmentation through hands-on wireshark captures to see how ttl limits hops and prevents routing loops in ipv4 tcp traffic.
Discover how TCP delivers reliable, ordered data in the transport layer through its header fields and ports, enabling flow control and protocols like HTTP, HTTPS, FTP, SSH, and SMTP.
Analyze tcp traffic with wireshark by inspecting tcp packets, their flags, sequence and acknowledgement numbers, and the three-way handshake, then observe tls negotiation over https on port 443.
Explore the User Datagram Protocol (UDP), a fast, connectionless transport for real-time data. Identify use cases like DNS, DHCP, VoIP, gaming, and streaming, with application-layer reliability as needed.
Analyze udp traffic with wireshark to understand connectionless dns queries and responses over udp port 53. Trace transaction IDs, recursion flags, and multiple a records that enable dns load balancing.
Master the DHCP handshake with Wireshark through hands-on packet capture. Trace the Dora flow: discover, offer, request, acknowledge, across fields, ports 67/68, and options like lease time, DNS, and gateway.
Explore the HTTP protocol structure, including methods like GET, POST, DELETE, PATCH, and HEAD, and understand how headers—request, general, and entity—guide client-server communication.
Analyze http request and response packets to understand browser–server communication, headers, and the security differences between http and https, using Wireshark to capture and inspect login and resource requests.
Shift from troubleshooting to security focused packet analysis; reveal attacker reconnaissance, exploitation, and persistence through traffic and packets, and how intrusion detection systems flag suspicious activity.
Master tcp synchronization scanning with wireshark and nmap to map open, closed, and filtered ports and learn how stealthy half-open scans evade detection.
Analyze a TCP synchronization (half-open) scan in Wireshark, using Nmap to identify open ports and responses (synchronization ACK, reset, no response). Use the statistics and conversations to interpret traffic.
Embarking on your journey with Wireshark can indeed feel overwhelming. I vividly recall my initial encounter with a trace file, where questions like "What should I look for?", "Where do I start?", and "What is 'normal'?" flooded my mind. The sheer volume of packet details left me momentarily paralyzed.
If you've ever experienced similar feelings when analyzing a pcap file, this course is tailored for you.
In this course, we'll delve into real-world scenarios to demonstrate practical applications of Wireshark in solving network issues. This skill set is invaluable for IT professionals aiming to enhance their analytical and troubleshooting capabilities. Our hands-on labs are designed for active participation: you'll download trace files, tackle accompanying questions, and piece together network puzzles embedded within the packets.
As we navigate the intricacies of packet analysis, we'll also familiarize ourselves with the Wireshark interface. You'll learn to configure custom columns, apply filters, and set up coloring rules, all aimed at customizing the layout to swiftly identify problems. By the end of this course, you'll be comfortable with the Wireshark interface and possess the expertise to comprehend core protocols.
My name is Typhon, and I bring years of experience in network analysis and troubleshooting. Throughout this course, I integrate real-world examples into every lecture, exercise, and assignment. My goal is to help you become adept with the Wireshark interface, interpret packet data effectively, and extract actionable insights to resolve issues or detect security incidents promptly.
Ready to embark on this journey? Let's dive into the packets together!