Wireshark Network Packet Analysis Training Course

Course overview

Network incidents, intermittent application failures and suspected data exfiltration are often hidden in packet captures that are too large to inspect manually. Security and network professionals need to move beyond basic filtering: they must establish a capture scope, isolate suspicious conversations, reconstruct application behaviour and distinguish normal protocol activity from evidence worth escalating. This course equips participants to use Wireshark as a disciplined investigation tool for troubleshooting, incident response and evidence-led security analysis.

Across five days, participants work with Wireshark’s capture options, display-filter language, profiles, colouring rules, statistics views and expert information. They analyse Ethernet, ARP, IPv4, IPv6, TCP, UDP, DNS, DHCP, HTTP, TLS and SMB traffic; follow streams; inspect retransmissions and handshake failures; extract transferred objects; and identify indicators associated with scanning, credential attacks, command-and-control communications and data transfer. The course also covers capture planning, PCAP handling, TShark automation and techniques for documenting findings so that another analyst can reproduce the investigation.

Delivery combines instructor demonstrations with guided packet analysis labs using realistic PCAP files from network faults and cyber security incidents. Participants progressively build a reusable Wireshark investigation workbook containing validated display filters, capture filters, protocol checklists, an escalation decision framework and a written incident findings report. This provides both the attendee and their manager with a practical reference for applying consistent packet-analysis methods after the course.

Course objectives

By the end of this course, participants will be able to:

• Configure Wireshark capture interfaces, ring buffers and capture filters for targeted packet acquisition
• Construct Wireshark display filters using protocol fields, Boolean logic, slices and regular expressions
• Interpret TCP handshakes, sequence numbers, retransmissions, resets and window behaviour to diagnose session failures
• Reconstruct DNS, HTTP, TLS and SMB conversations using Follow Stream, protocol trees and object export
• Use Conversations, Endpoints, I/O Graphs, Flow Graph and Expert Information to prioritise anomalous traffic
• Identify packet-level indicators of reconnaissance, credential attacks, command-and-control and data exfiltration
• Apply TShark commands to filter PCAP files, extract fields and produce repeatable investigation outputs
• Produce an evidence-based packet analysis report with timelines, annotated findings and recommended next actions

Benefits of attending

Target competencies

Who should attend

• Security Analysts — who need to validate alerts and investigate suspicious network communications
• Network Engineers — who troubleshoot latency, packet loss, protocol failures and application connectivity
• Incident Responders — who require defensible packet evidence during containment and post-incident analysis
• SOC Analysts — who must triage network detections before escalating incidents
• Cyber Security Engineers — who tune network controls and verify whether security tooling sees relevant traffic
• Digital Forensics Practitioners — who need to extract and document network evidence from PCAP files

Requirements and prerequisites

Participants should be comfortable using Windows or Linux command lines, navigating files and interpreting basic IP addressing, subnetting, ports and client-server communication. They should already understand the purpose of TCP, UDP, DNS and HTTP at a foundation level, and have some experience of network troubleshooting, security monitoring or incident handling. Prior exposure to Wireshark is useful but not essential; the course starts by establishing an effective working configuration before moving quickly into advanced analysis. Programming, malware reverse engineering, penetration-testing experience and prior TShark scripting are not required.

Training methodology

Instructor-led sessions introduce each Wireshark feature in the context of an operational investigation, followed by guided analysis of curated PCAP files. Participants configure capture and display filters, inspect protocol fields, compare normal and anomalous flows, and use statistics views to form and test hypotheses. Small-group case work covers application outages, suspicious DNS activity and suspected data transfer. Daily debriefs convert observations into documented findings. The final workshop requires participants to analyse an unfamiliar capture and prepare an investigation summary, filter set and recommended response actions.

Course outline

Day 1: Capture strategy and Wireshark foundations

• Packet capture scope, legal authority and evidence-preservation considerations
• Wireshark interface configuration, profiles, columns and packet-list customisation
• Capture interfaces, promiscuous mode, monitor mode and capture-file formats
• BPF capture filters for hosts, networks, ports and protocols
• Display-filter syntax, comparison operators, Boolean logic and protocol-field discovery
• Packet dissection across Ethernet, ARP, IPv4, IPv6 and ICMP
• Time display formats, packet comments, colouring rules and marked packets

Workshop: Participants configure an investigation profile and capture-filter plan for a suspected workstation compromise, producing a documented filter and acquisition checklist.

Day 2: Transport and service protocol analysis

• TCP three-way handshake, teardown, flags and connection-state interpretation
• Sequence numbers, acknowledgements, window scaling and selective acknowledgements
• Retransmissions, duplicate acknowledgements, resets and zero-window conditions
• UDP behaviour and packet-loss interpretation in connectionless services
• DNS query-response analysis, record types, recursion and suspicious lookup patterns
• DHCP lease exchange analysis and endpoint attribution
• HTTP request-response inspection, headers, status codes and exported objects

Workshop: Participants analyse a PCAP from a failing business application and produce a root-cause hypothesis supported by TCP and HTTP packet evidence.

Day 3: Encrypted traffic, file services and traffic visualisation

• TLS ClientHello and ServerHello fields, cipher suites, extensions and certificate inspection
• TLS decryption prerequisites, key logs and limitations of encrypted-traffic analysis
• SMB session setup, file operations and authentication-related packet fields
• Follow TCP Stream, Follow UDP Stream and stream-content reconstruction
• Export Objects for HTTP, SMB and TFTP transfer recovery
• Conversations and Endpoints statistics for host and service profiling
• I/O Graphs, Flow Graph and Expert Information for anomaly prioritisation

Workshop: Participants investigate a suspected unauthorised file transfer, producing a communication timeline, extracted artefact list and evidence annotations.

Day 4: Threat hunting and incident investigation with PCAPs

• Packet-level indicators of port scanning, service enumeration and brute-force attempts
• DNS tunnelling indicators including query length, entropy and response patterns
• Command-and-control characteristics including beaconing, periodicity and unusual destinations
• Credential exposure analysis in cleartext protocols and legacy authentication exchanges
• Data-exfiltration indicators using packet sizes, transfer direction and long-lived sessions
• Display filters for hunting by IP address, domain, SNI, user agent and protocol field
• PCAP scoping, pivoting and timeline construction for incident triage

Workshop: Teams investigate an intrusion scenario PCAP and produce a prioritised set of indicators, affected assets and containment recommendations.

Day 5: Repeatable analysis and operational reporting

• TShark syntax for reading captures, applying filters and selecting output formats
• TShark field extraction, CSV output and command-line investigation pipelines
• Capture-file management, PCAPNG metadata, file integrity and retention considerations
• Wireshark configuration profiles, saved filters and team filter-library design
• Analyst note-taking, packet references and reproducible evidence chains
• Incident findings reports with executive summary, technical evidence and remediation actions
• Escalation thresholds and handover practices for SOC, network and incident-response teams

Workshop: Participants complete a timed end-to-end PCAP investigation and submit a Wireshark filter pack, annotated timeline and concise incident findings report.

Tools & standards covered

Wireshark, TShark, tcpdump, PCAPNG

A typical training day

Live online deliveries follow the same structure in the East Africa Time zone, with shorter screen blocks and longer breaks.

What the fee includes

How you can take this course

Certification

Participants who complete the full five days receive the Skillset Development Certificate of Completion, stating the course title, course code, dates and delivery format — suitable for professional-development records and employer reimbursement.

Frequently asked questions