Wireshark for Threat Hunting & Network Forensics

Network traffic can tell you a lot about what is happening inside a computer network. During a cyber attack, attackers leave many signs in network traffic. If you know how to read and analyze these signs, you can understand what happened, how the attack happened, and what the attacker was trying to do.

This course will help you learn Wireshark from a practical cybersecurity point of view. You will not just learn where different Wireshark features are or how to apply basic filters. Instead, you will learn how security analysts use Wireshark and packet captures (PCAPs) to investigate real-world security incidents, find suspicious activity, and understand network-based attacks.

The course is designed with a strong focus on hands-on learning. You will work with realistic network traffic and investigation scenarios that are similar to the type of problems faced by cybersecurity and SOC teams. You will learn how to look at network packets, identify unusual behavior, follow network conversations, and collect useful information from a PCAP file.

During the course, you will investigate different types of security incidents, including malware traffic, Command and Control (C2) communication, DNS tunneling, credential attacks, lateral movement, data exfiltration, suspicious connections, protocol-related issues, and network anomalies. You will learn how attackers communicate with compromised systems and how this communication can be identified from network traffic.

You will also learn how to use Wireshark to investigate an incident step by step. This includes finding important packets, applying useful display filters, following TCP and HTTP streams, analyzing DNS requests, checking IP addresses and domains, identifying suspicious connections, and understanding the behavior of different network protocols.

Another important part of the course is learning how to build a clear picture of an attack. You will learn how to create an attack timeline by connecting different network events. You will also learn how to identify Indicators of Compromise (IOCs) such as suspicious IP addresses, domains, URLs, file hashes, and other useful information that can help security teams detect and respond to threats.

The course also introduces several tools and resources that are commonly used in cybersecurity investigations. Along with Wireshark, you will work with Tshark, CyberChef, MITRE ATT&CK, and publicly available PCAP datasets. These tools will help you understand how network analysis fits into a larger cybersecurity investigation.

You will also learn how to connect network evidence with common attacker techniques using the MITRE ATT&CK framework. This will help you understand not only what you are seeing in the packets, but also how that activity may relate to a larger attack.

The course focuses on learning by doing. Instead of spending most of the time on theory, you will follow practical demonstrations and work through investigation examples. You will gradually learn how to approach a PCAP file, what to look for, which filters to use, how to identify suspicious traffic, and how to reach a conclusion from the available evidence.

You will also learn some useful techniques for network troubleshooting and protocol analysis. These skills are useful not only for cybersecurity investigations but also for understanding how applications and systems communicate over a network.

By the end of the course, you will have a much better understanding of how network traffic can be used as evidence during a cybersecurity investigation. You will be able to open and analyze PCAP files, use Wireshark filters, investigate network conversations, identify suspicious behavior, extract useful evidence, and build a basic attack timeline.

You will also understand how to approach network-based threat hunting in a structured way instead of simply looking at packets randomly. The goal is to help you develop the same type of thinking used by cybersecurity analysts when investigating suspicious network activity.

This course is suitable for college students, cybersecurity beginners, SOC analyst aspirants, networking students, Blue Team learners, and anyone interested in digital forensics and incident response (DFIR). It can also be useful for learners who already know the basics of networking and want to develop practical Wireshark and network investigation skills.

Whether you are preparing for a SOC Analyst or Network Security role, working on your cybersecurity skills, learning about incident response, or simply want to understand Wireshark beyond basic packet analysis, this course provides a practical and structured way to learn.

By completing the course and practicing the investigations, you will build the confidence to approach real network traffic, ask the right questions, find important evidence, and understand what the traffic is telling you about a possible security incident.