Getting Started with Wireshark-The Ultimate Hands-On Course

This video gives us an introduction to how this Wireshark course will flow and how to follow along.

Let's do a quick review of what we learned in this section of the course.

The first thing to learn about filtering traffic is the difference between a capture filter and a display filter. Capture filters are configured before the capture begins rolling. You only capture the specific traffic you are filtering for. This is a nice feature to use when you understand a few details about the problem and you want to keep the pcap small. Display filters are for post-capture filtering. They are designed to be applied, adjusted, or even removed. The original capture file stays the same. Let's learn some!

The first filters you will learn are IP address and conversation filters. It is easier to memorize them when you have hands-on practice. So get out the pcap from Lab 1 and get some hands-on.

In this lecture and demonstration we will learn how to filter for common protocols and TCP/UDP port numbers. Make sure to have the pcap ready to follow along!

Now that we know how to filter for ARP, IP, DNS, TCP and other protocols, let's learn how to filter for specific conversations in the pcap.

In this lecture we will learn about using the and, not, or, gt, and lt operators for creating more complex filters.

Let's learn some scenarios when to practically use the and, not, or, gt and lt operators.

The Wireshark display filter syntax also includes the "contains", "matches", and "in" operators. These open up the ability to search for text strings using regular expressions, or membership operators. Let's dig.

In this lecture we look at examples of how to use "contains", "matches" and the "in" operators.

Let's review the filters we learned.

When a problem strikes, it is tempting to jump straight into Wireshark and start capturing traffic to save the day. Before getting too excited - let's back up a minute. Before clicking the blue sharkfin, there are some things we need to think about. Getting answers to the questions covered in this clip will save a ton of time when we start looking at a problem from the packet level.

Switches isolate traffic to the ports directly involved in pathing the traffic. This can make it difficult to "listen in" with Wireshark and capture. In switched environments, we need to use one of the three methods of capture explained in this video to get to the right packets.

Sometimes one point of view is not enough to solve a problem. In this clip we will discuss why a multi-point capture can be needed in some troubleshooting scenarios.

Before we click "capture", we need to decide whether or not to use a capture filter. This will only collect the traffic we specify, allowing us to focus on a specific conversation, port, protocol, or subnet.

Let's learn more about what happens when we click the blue fin!

Sometimes problems aren't so easy to capture in the act. Especially the ones that come and go. In this lecture we will learn about how to configure Wireshark for long-term capture so we can get everything! 

Command line capture is a quick way to collect packets on a system we SSH into, or for times when we don't want to use the full Wireshark GUI. Let's learn how to set this up in both Windows and MacOS.

Now that we have the basics of setting up command line capture, let's learn how to configure that ring buffer - but this time from the CLI.

Let's test our knowledge of what we learned in this module.

In this lecture we will dig into the Ethernet frame layout and show how each field works. We will also do a local capture in our own environment with Wireshark and take a peek at the MAC addressing.

There are three basic communication types in ethernet. Unicasts, broadcasts, and multicasts. Let's learn each one and how they work.

In this lecture we comb the IP protocol header values, describing how each value works to deliver traffic across the internet between endpoints. We will learn IP Diffsrv, IP identification numbers, TTL, and protocol ID's.

Walk the network path like a packet would and learn how a new ethernet frame is built by every router along the path. 

This is a quick introduction to this section about the IP Protocol. We were introduced to it in the last section, but now we will dig much deeper into it!

Let's look how we can practically use the IP ID field to analyze and troubleshoot network problems.

The TTL field can help us to determine how far apart endpoints are in terms of router hops. Let's see how we can use this field for practical analysis.

Let's send some large pings, capture them, and see how IP fragmentation works.

The "Do not fragment" bit is important to learn in the IP header. We'll look at how to use it practically.

It is possible that attackers could make use of IP fragmentation when scanning networks to try to avoid triggering IDS/IPS alerts. Let's look at an example.

IPv6 is rapidly being deployed throughout enterprise networks today. In this video we will look at the header structure and see how it is different than IPv4.

In order to use the GeoIP location feature of Wireshark, we first have to download the databases from Maxmind. Due to licensing restrictions, these need to be downloaded directly with a free account. It is worth it to download them!

We captured a scan that was coming in from several different areas of the world. In this video, we take a closer look at this DDoS attack with GeoIP.

Don't underestimate UDP. It has a huge (and growing) presence on networks today. Critical services like DHCP, DNS, and VoIP have been running over UDP for decades. But more and more we are seeing emerging protocols such as QUIC and even RDP over UDP. Let's learn how to analyze these protocols.

When an endpoint first joins a network, it has to get an address, routing, subnet, and DNS information. This happens over the UDP-based protocol: DHCP. In this lecture we will see how this critical service works.

DNS is the phone book of the internet. Applications cannot function without it. If DNS is slow or broken, services will simply not work. In this video we will dig into DNS and learn how to analyze requests and responses, as well as measure DNS response time with Wireshark filters.

Let's kick this section off with a brief overview of what we will learn about TCP.

There is quite a bit that gets exchanged in the initial handshake of a TCP connection. Let's see why this part of the conversation is so important to capture.

In this clip we will take a hands-on look at the handshake and the flags that make TCP tick.

TCP options came about to extend the capabilities of the protocol. In this video we will learn about MSS, Window Scaling, Selective ACK, and timestamps.

Sequence and acknowledgement numbers are the underlying function of how TCP works to deliver data reliably. Let's make sure we are comfortable with how these numbers work.

If data does not arrive at the receiver, or if the acknowledgement does not arrive at the original sender, TCP will retransmit it. Let's take a closer look at how this function works.

Let's learn how TCP closes down connections. The two major ones are by using the FIN flag or by using resets.

Let's do a quick review of the things we learned in this section of the course.

This section will bring all the analysis skills together that we learned in this course. Let's learn the top five things to look for in the packets.

In this video we will look at how to identify slow application performance in web based applications, even in secure connections.

If network latency is high or if an application suffers from many turns (requests and replies), applications will lag. We'll take a look at how to quickly spot this in Wireshark.

When we move large amounts of data across a network from one endpoint to another, we have to have healthy TCP Receive windows to catch it. Low or zero windows can bring file transfers to a grinding halt and there is nothing that the network can do about it! Let's see how to identify these issues.

I receive quite a few complaints from people suffering from network or application disconnects. This video shows what I look for in the packets to hunt down the root cause.

This lecture will give you an assignment to do on your own network after completing this course.