Wireshark Mastery: Network Traffic Analysis

Master the difference between capture filters and display filters in Wireshark, learn shortcuts for applying them, and practice capturing FTP traffic via port 21 while interpreting filter color feedback.

Apply and combine Wireshark display filters to show tcp traffic by sequence numbers and identification numbers, use prepare and apply options, and build custom expressions.

Explore the seven-layer OSI model and encapsulation, detailing each layer's function, PDUs, and addresses from application to Ethernet II frames.

Map frame generation and encapsulation from data to the frame check sequence, showing ethernet II frames, IP packets, and TCP/UDP segments in Wireshark and their OSI model context.

Explore the tcp/ip suite, including ip, icmp, tcp, and udp, and how they route, address, and deliver across network and transport layers, with application protocols like http, ftp, and smtp.

Explain tcp at the transport layer, including the three-way handshake, and inspect tcp header fields in Wireshark—from ports, sequence and acknowledgment numbers, to flags and window size.

See how tcp uses a three-way handshake, syn, syn-ack, and final ack, to establish a connection. Identify termination via fin exchanges and timeouts, and signs of firewall or icmp issues.

Explore the tcp three-way handshake and teardown in a Wireshark capture, highlighting client and server exchange, and session termination with tcp headers and options such as maximum segment size 1460.

Explore how the user datagram protocol provides a connectionless, lightweight transport with eight-byte header, four fields, and how IPv4 and IPv6 affect UDP checksum in DNS and voice over IP.

Analyze IPv4 headers in Wireshark, exploring version four, header length, differentiated services and quality of service, best effort, total length, fragmentation fields, time to live, and TCP checksum.

Explore ipv6, the network layer upgrade that replaces broadcast with multicast, uses a streamlined header with optional extension headers, and supports both stateful and stateless auto configuration.

Explore icmp at the network layer, delivering error reports and echo request and echo reply messages. Highlight type 3 destination unreachable and how icmp guides traceroute and network reachability.

Explore how ICMP version six, an integral part of IP version six, handles echo requests and replies, error messages, and neighbor discovery with neighbor solicitations and advertisements.

Master DNS by mapping host names to IP addresses, using UDP 53 for queries and TCP 53 for zone transfers, and review A, AAAA, MX records and DNS header fields.

Explore how DHCP operates on the application layer to dynamically assign IP addresses via the discover, offer, request, and acknowledge sequence, using UDP ports 67 and 68, with Wireshark examples.

Analyze ftp traffic patterns by following a tcp stream to observe the classic vs passive ftp handshake, port 21 command channel, port 20 data, and the extended passive mode response.

Explore http, the web's application layer protocol, uses a client-server model over port 80 to send requests and receive responses, with status codes and http headers and body.

Explore how ARP resolves an IP address to a MAC address on a local area network, sitting between layer three and layer two, with ARP requests, replies, and gratuitous ARP.

Explore the Wireshark expert system for packet captures. Learn how expert info flags errors, warnings, notes, and chats by severity and how to review and adjust alerts.

Identify network latency with wireshark’s built-in tools, expert coloring rules, and time values to detect gaps in transmission, zero window conditions, retransmissions, and queuing delays from full buffers.

Save packets in wireshark using save as for the full file or export marked packets. Filter with display filter or mark icmp frames to save only the selected packets.