NetworkNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.Wireshark / Packet Capture
Capture, filter and read packets in Wireshark and tshark to recover what was sent.
- Beginner
- Online or on campus
- 5 hands-on labs
- 7 modules
About this course
Wireshark is the tool most investigators open first when they get a PCAP file, and also the one most people use badly. They scroll through thousands of packets hoping something will stand out. This course teaches a better way. You learn to capture cleanly, filter hard and go straight to the conversation that matters.
You start with how to capture without losing packets and without changing the evidence, then learn the two filter languages, capture filters and display filters, and why mixing them up is a common mistake. From there you follow TCP streams, rebuild web pages and emails, pull out files with Export Objects and read DNS, HTTP, SMB and TLS traffic.
Encryption gets an honest treatment. Most traffic today is TLS, and you learn what you can still see (server names, certificates in older versions, timing and size) and what you cannot see without the session keys. The course ends with tshark so you can handle captures that are too big for the Wireshark window.
Capture and display filtersTCP streamsExport objectstshark
After this course you can
- Capture traffic on a host or network segment and save it as hashed, documented evidence
- Write correct capture filters in BPF syntax and display filters in Wireshark syntax
- Follow TCP and HTTP streams to rebuild a conversation between two hosts
- Extract files from HTTP, SMB and other protocols with Export Objects and verify them by hash
- Explain what TLS hides, what it leaves visible and when decryption with a key log file is possible
- Use tshark to filter, split and summarise large captures from the command line
Syllabus
7 modules · 28 topics
01Packet capture basics4 topics
- How Wireshark and dumpcap capture, and the pcap and pcapng formats
- Promiscuous mode, Wi-Fi monitor mode and their limits
- Ring buffers for long captures without filling the disk
- Hashing, naming and recording a capture as evidence
02Capture filters and display filters4 topics
- Capture filters in BPF syntax, such as host 10.0.0.5 and port 443
- Display filters, such as ip.addr == 10.0.0.5 && tcp.port == 443
- Why a capture filter drops packets for good and a display filter only hides them
- Building filter buttons and profiles for repeated tasks
03Reading conversations4 topics
- The TCP handshake, sequence numbers, retransmissions and resets
- Follow TCP Stream, Follow HTTP Stream and Follow UDP Stream
- Statistics menus: Conversations, Endpoints, Protocol Hierarchy and I/O Graphs
- Spotting scans, failed logins and odd ports
04Protocols that carry evidence4 topics
- DNS queries and responses
- HTTP requests, headers, cookies and form posts
- SMB file access and FTP sessions
- SMTP, POP3 and IMAP email in clear text
05Recovering files and content4 topics
- File > Export Objects for HTTP, SMB, TFTP and IMF
- Carving files from a raw stream when Export Objects misses them
- Checking recovered files by hash against known samples
- Using NetworkMiner as a second view of the same capture
06TLS and what you cannot see4 topics
- The TLS handshake and the Server Name Indication field
- Certificates in TLS 1.2 and why TLS 1.3 encrypts them
- JA3 and JA4 fingerprints for identifying client software
- Decrypting with an SSLKEYLOGFILE key log when one exists, and its limits
07tshark and large captures4 topics
- Reading and filtering captures with tshark -r and -Y
- Exporting chosen fields with -T fields -e to a CSV
- Splitting and merging captures with editcap and mergecap
- Checking capture details with capinfos
Hands-on labs
- Lab 1
Capture traffic from a test machine with a ring buffer and hash each file
- Lab 2
Rebuild a clear-text login and a web form submission with Follow TCP Stream
- Lab 3
Recover a document sent over SMB with Export Objects and match its hash
- Lab 4
Decrypt a TLS session using a browser key log and compare what was visible before and after
- Lab 5
Use tshark to pull every DNS query from a 2 GB capture into a spreadsheet
Tools you will use
- Wireshark
- tshark
- dumpcap
- editcap and mergecap
- capinfos
- NetworkMiner
- tcpdump
Who it suits
- Students starting in network forensics
- Police and lab staff who receive PCAP files with cases
- Network engineers who want to use Wireshark for investigation
- SOC analysts who need to confirm alerts at the packet level
Before you join
- Basic idea of IP addresses, ports and how a website loads
- Comfort with installing software and using a command prompt
Questions about this course
Can Wireshark read encrypted WhatsApp or HTTPS traffic?
Not on its own. Wireshark can show who talked to whom, when and how much, and often the server name. It cannot read the content of encrypted traffic unless you have the session keys, for example a browser key log captured on the same machine. App traffic such as WhatsApp uses end-to-end encryption, so the content is not available from the network.
Is Wireshark free to use?
Yes. Wireshark and tshark are free and open source and run on Windows, Linux and macOS. You can keep practising on your own machine after the course.
Is this course enough for the Network Investigator certification?
It is one of the two courses that count towards DCNI. The other is Network Traffic Analysis, which covers logs and flow data.
More courses in Network & Cloud Forensics
NetworkNetwork Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft.
NetworkCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.
NetworkVirtual Machine / Hypervisor ForensicsExamine VMDK, VHDX and QCOW2 disks, snapshots, ESXi logs and VM memory files.Not sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.