TCP/IP Network Traffic Analysis with Wireshark Training Course

Overview of Network Analysis

1. Essentials of the OSI reference model and TCP/IP networks.
2. Troubleshooting tools and methodological approaches.
3. Introduction to Wireshark
4. What is Wireshark? Portable versions and available resources.
5. Wireshark GUI layout: Panes (Packet List, Details, Packet Bytes), Status Bar, etc.
6. Internal architecture and processing flow; limitations of what Wireshark can visualize.
7. Supported protocols and dissection mechanisms.
8. Managing preferences and configurations, both global and profile-specific.
9. Interpretation of time values.
10. Practical lab exercises.

Capturing Network Traffic

1. Pre-capture considerations.
2. Promiscuous mode settings.
3. Configuring capture filters.
4. Defining automatic stop criteria.
5. Remote capture capabilities.
6. Practical lab exercises.

Traffic Analysis: Tools and Methodologies

1. Developing an analysis checklist.
2. Leveraging features: name resolution, color coding, marking, ignoring packets, commenting, time references, and time shifts.
3. Understanding the Expert System for error identification.
4. Accessing context-specific options via right-click functionality.
5. Interpreting data through reference patterns; assessing the impact of OS/driver Offload features.
6. Saving analysis results.
7. Lab exercises and real-world case studies.

Traffic Analysis: Tools and Methodologies (Continued)

1. Filtering traffic: Display filters (creating 'in-flight' filters, using macros) and following data streams.
2. Quantitative analysis.
   1. Basic predefined descriptive statistics and summaries: Capture Properties, Protocol Hierarchy, Conversations, Endpoints, Packet Lengths, and IP-specific metrics.
   2. Protocol-specific analysis (e.g., TCP Stream Graphs).
   3. Advanced custom statistics using I/O Graphs.
   4. Visualizing data flows.

Traffic Analysis: Protocol Deep Dive

1. Data-Link Layer: Ethernet II.
2. Network Layer: IPv4.
3. Transport Layer: TCP and UDP.
   1. Diagnosing packet loss and recovery mechanisms.
   2. Analyzing 'Previous segment lost' and 'Out-of-Order Segments' events.
   3. Identifying Duplicate ACKs and Fast Retransmissions.
   4. Investigating TCP Retransmissions.
   5. Understanding Zero Window, window size changes, and other window-related issues.
4. Application Layer: HTTP and FTP.
5. Practical lab exercises and case studies.

Traffic Analysis: Common Performance Assessment Issues

1. Identifying root causes of performance degradation.
2. Analyzing packet loss.
3. Addressing bandwidth constraints; adopting a layered approach to measurement.
4. Latency analysis: assessing end-to-end latency and visualizing data points.
5. Practical lab exercises.
6. Wireshark command-line utilities:
   1. tshark (terminal-based Wireshark), dumpcap, rawshark, and tcpdump
   2. editcap, mergecap, capinfos, and text2pcap.

Advanced Topics

1. Advanced filtering techniques and grouped I/O statistics.
2. Course summary and Q&A session.