Wireshark Essentials: Capture, Analyze, & Secure Network

Explore how to use capture and display filters in Wireshark, including syntax, shortcuts, and feedback colors, to isolate ftp traffic via port 21 and clear filters by rebooting.

Explore Wireshark display filters for TCP traffic, using sequence number zero, prepare and apply filters, and build expressions with operators to focus the data you analyze.

Master the seven-layer OSI model, encapsulation, and how data transforms into frames, packets, and segments with MAC and IP addressing, and key protocols like HTTP, FTP, and SMTP.

Build a frame by encapsulating data into a segment, IP header, and MAC frame header, then analyze the OSI layers and CRC trailer in Wireshark.

Explain how tcp uses a three-way handshake to establish a socket and enable data exchange, and how termination occurs via timeout, reset, or fin and fin-ack, with icmp destination-unreachable messages.

Explore the tcp handshake and teardown in Wireshark, analyzing the three-way handshake, frame structure, and tcp options such as mss, sack, timestamp, and window scaling.

Explore how UDP delivers a connectionless, lightweight transport with eight-byte header (source port, dest port, length, checksum) for DNS, voice over IP, Trivial File Transfer Protocol, with IPv6 mandatory checksum.

Explore IPv4 at the network layer, focusing on addressing, routing, and a connectionless, best-effort delivery; review header fields, fragmentation, ttl, checksum, and source/destination addresses.

IPv6 expands the address space to 128 bits with hexadecimal notation, replaces broadcast with multicast, and supports stateful and stateless auto-configuration with a streamlined header and ICMP reliance.

Explore how icmp operates within the internet protocol, highlighting error reporting and query messages, including type three destination unreachable, echo requests/replies, and the ip header.

Explore ICMPv6 as an integral part of IPv6, handling echo requests and replies, errors, and neighbor discovery, including solicitation and advertisement, plus multicast listener discovery, replacing ARP and IGMP.

Explore how the domain name system translates hostnames to IP addresses using UDP 53 for queries and TCP 53 for zone transfers, and handles records like A, MX, and AAAA.

Demonstrate how dhcp dynamically assigns ip addresses on a local area network using udp ports 68 and 67, and walk through the dora process: discover, offer, request, and acknowledge.

Learn how FTP uses ports 20 and 21, with port 21 as the command channel and port 20 for data, and compare active and extended passive modes for firewall-friendly transfers.

Explore hypertext transfer protocol, an application layer client-server model using tcp port 80, featuring requests, responses, headers, and the html body that builds web pages.

Learn how the address resolution protocol resolves an IP address to a MAC address on a local area network, with ARP requests, replies, and gratuitous ARP tests.

Explore Wireshark's expert system, which provides insight on possible issues in a packet capture by severity levels: error, warning, notes, and chats.

Master Wireshark essentials to diagnose network latency using expert information, coloring rules, and time values, identifying gaps in transmission and zero window.

learn how to save complete pcap files or export specific packets in wireshark using save as, display filters, and mark, including saving icmp packets.