Hands-On with Wireshark - Your First PCAP Lab
Configuring the Wireshark Interface
Filtering Traffic in Wireshark
-
Introduction to Wireshark Filters (3:38)
-
Capture Filters vs Display Filters (3:15)
-
Filtering for IP Addresses, Source or Destination (6:21)
-
Filtering for Protocols and Port Numbers (4:10)
-
Filtering for Conversations (7:40)
-
Operators in Display Filters (1:21)
-
Demo: Using Operators when Filtering Traffic (9:42)
-
Special Operators - Contains, Matches, and In (3:01)
-
Demo: How to Use Special Operators When Filtering (5:19)
-
Lab 3 - Creating Display Filters in Wireshark (12:50)
-
Section Review (1:34)
Where and How to Capture Packets
-
Think BEFORE You Capture! (2:14)
-
How To Capture In a Switched Environment - Local Capture vs SPAN vs TAP (6:16)
-
Capturing at Multiple Locations (1:54)
-
Should We Use a Capture Filter? (2:39)
-
Capturing Traffic with the Wireshark User Interface (4:50)
-
How to Capture Intermittent Problems - Long Term Capture Configuration (6:32)
-
How to Capture on the Command Line with Dumpcap (7:38)
-
Configuring a Ring-Buffer on the CLI (2:49)
-
How and Where to Capture Packets?
-
Section Review (1:18)
The Anatomy of a Packet - How Encapsulation Works
-
Packets and the OSI Model (3:46)
-
Ethernet - The Frame Header (6:00)
-
Unicasts vs Broadcasts vs Multicasts (3:16)
-
The Internet Protocol - Learning the Header Values (8:37)
-
Following a Packet Through the Network - Re-Encapsulation (8:32)
-
Lab 4 - Analyzing a Packet From Multiple Capture Points (7:51)
-
Section Review (1:12)
Practical IP Analysis
-
Section Overview (0:29)
-
Digging Deeper into the IP ID (3:36)
-
How to Use the TTL Field (5:34)
-
How IP Fragmentation Works (7:51)
-
The IP Flags (1:53)
-
Whoa! Investigating Suspect Scan Activity (4:03)
-
A Look at IPv6 (7:00)
-
Configuring Wireshark to Find GeoIP Locations (3:56)
-
Analyzing a DDoS Attack with GeoIP (3:48)
-
Lab 5 - Is this scan as bad as it looks? (8:51)
-
Section Review (1:01)
Practical UDP Analysis
Practical TCP Analysis
-
Section Intro (1:11)
-
Practical TCP - The Handshake (4:24)
-
Hands-On with TCP Flags (8:53)
-
Analyzing TCP Options (6:04)
-
How Sequence and Acknowledgement Numbers Work (5:59)
-
Digging into Retransmissions (9:32)
-
Let's Shut it Down - FINs vs Resets (5:55)
-
Lab 6 - Is it the Client, Network, or Server? Can You Isolate the Problem? (6:11)
-
TCP Analysis Review (1:03)
The Top Five Things to Look For When Troubleshooting with Wireshark
-
Putting it All Together - Section Intro (0:23)
-
1. Slow Application Response Time (7:00)
-
2. High Network Latency (2:48)
-
3. Network Packet Loss (3:28)
-
4. Slow File Transfers - TCP Window Problems (5:58)
-
5. Network/Application Disconnects - TCP Resets (6:35)
-
What to do next with Wireshark - Where to go from here? (1:16)
Course Wrap-Up
