Wireshark for SOC Analyst & AI-Powered Analysis

Understand cyber security as a practice to protect systems from unauthorized access, ensure data integrity, confidentiality, and availability, and explore core areas like network, information, and endpoint security.

Explore common cyber attacks such as malware (ransomware, spyware, adware, viruses), man-in-the-middle, password attacks, phishing, denial-of-service, botnets, and web vulnerabilities like SQL injection, cross-site scripting, and cross-site request forgery.

A security operations center, or SOC, is a centralized unit that detects, prevents, and responds to threats in real time using SIEM and EDR, guided by incident response.

Explore core soc tools for detection and response—sim, edr, threat intel, incident response, and itsm—and how soar workflows enable automation.

Explore the OSI model framework and its seven layers from physical to application, showing data link and network layer roles, MAC and IP addresses, switches, and routers.

Explore the address resolution protocol (arp) and how devices map ip addresses to mac addresses using arp broadcasts to build mac tables for local area network communication.

Learn to customize Wireshark preferences to tailor appearances, columns, fonts, and colors. Configure captures, promiscuous mode, and PCAPNG outputs; optimize name resolution, protocols, and expert filters for security analysis.

Explore packet list, packet details, and packet bytes in Wireshark, correlating layers from frame to application, including MAC addresses, IP addresses, ports, and hex data.

Learn to use capture filters in wireshark to limit data captured and sharpen analysis, then apply display filters to selectively view packets in real time.

Highlight and distinguish network traffic in Wireshark by creating color rules for specific packets, such as TCP flags and urgent traffic, to aid malware and protocol analysis.

Learn how the TCP three-way handshake (SYN, SYN-ACK, ACK) establishes a client–server connection and reliability before data transfer. See how Wireshark captures this handshake with IP-based filtering.

Understand the fin flag and fin three-way handshake to close connections, analyze flags such as synac, finac, and ack in Wireshark for soc analysis.

Analyze the tcp three-way handshake in Wireshark by capturing traffic to a Google ip and filtering for tcp.flags==1 to reveal fin, fin-ack, and ack exchanges.

Learn packet structure and header breakdown in Wireshark, reading a packet across frame, Ethernet, IP, transport, and application layers, and filtering by IP, port, and protocol for SOC analysis.

Master capture filters to reduce data captured and stored, then use display filters to refine traffic in real time during hands-on Wireshark practice.

Explore how the DNS works from resolver to authoritative servers, and detect anomalies like low TTL, fast flux, and CNAME clocking used in attacks.

capture and analyze dns traffic with wireshark, generate queries using nslookup, and inspect query and response details like transaction id, qr flag, recursion, and a records.

Explore the http protocol, including requests, responses, headers like host and cookie, status codes, and payloads, and learn wireshark filtering to analyze http traffic for security signals.

Analyze http traffic with Wireshark to inspect get and post requests, including request uri, host, user agent, cookies, and session id, plus redirects and 404 indicators from a soc perspective.

Learn how ssl and tls establish a secure, encrypted link between the browser and server, enabling https, data privacy and integrity, and protecting web, email, vpn, and api communications.

Explore how to analyze https and tls traffic in Wireshark, verifying tls versions and cipher suites, inspecting sni and certificates, while recognizing encrypted http content.

Explore how attackers use SYN scans to map open, closed, and filtered ports in real captures, surface the attack surface with Wireshark filters and nmap demonstrations.

Explore ICMP for host discovery and DDoS, including ping sweeps and ping floods, and learn to identify these patterns in Wireshark with ICMP filters.

A SOC analyst uses Wireshark to investigate malware command-and-control patterns, identifying unusual outbound HTTP/HTTPS traffic from an internal host with periodic check-ins and repeating requests.

Execute real-time cloud-based packet capture and analysis with a Python MCP server that wraps Tshark, enabling plain-English queries like top talkers, DNS queries, and TCP stream decoding.