Description
The purpose of the course is to provide the participant with in-depth practical knowledge of Wireshark protocol analyser and how to use it with additional tools for network analysis. In the course we talk about the software, TCP/IP core protocols, applications behaviour analysis, network forensics and how to use Wireshark and additional scripting tools for thorough analysis of network problems in medium to large scale networks. All topics covered in the course include theory, case studies and hand-on exercises, and is based on the new Wireshark version 3.
Objectives
By the end of the course, the participant will be able to:
- Understand Wireshark and use it for network analysis
- Understand the TCP/IP protocol suite and its behaviour over the network
- Understand common applications behaviour over the network
- Locate abnormal behaviour of network protocols and applications
- Troubleshoot network problems in small to mid-range enterprise networks
- Analyse performance degradation issues and locate their causes
- Locate the root cause for most common network problems
- Use Tshark and TCPdump for Network analysis
- Perform network analysis in high-speed large-scale networks
- Use Wireshark and scripting tools for network forensics
- Use Pyshark and scripting tools for network analysis
Target Audience
R&D, engineering and technical Support, IT and communications managers
Prerequisites
Basic knowledge in networking and the TCP/IP protocol stack (Introduction to Networking course level) with basic level understanding of Windows/Linux shell scripts and Python
Duration
5 Days
Outline
Introduction to Wireshark
- How Wireshark Works
- Capturing Packets
- Wireshark toolbars and menus
- Navigation and colorization techniques
- Using Time Values and Summaries
- Examining Basic Trace File Statistics
- Save, Export and Print
- Lab exercises and case studies
Where to locate Wireshark
- How to decide where to capture data from
- Taps and port-mirror
- Local and remote monitoring
- Capture data from multiple interfaces
- Capture data on virtual machines
- Lab exercises and case studies
Mastering Wireshark for efficient packet capture
- Capture data to single and multiple files
- Mergecap and file merging
- Capture data from local and remote interfaces
- Wireshark folders, configuration files and plugins
- Configure user interface, global and protocols preferences
- MAC/IP/TCP-UDP protocol resolution
- Import and export files
- Wireshark performance issues
- Working with profiles
- Lab exercises and case studies
Capture filters basics
- Capture filters syntax
- Compound capture filters
- Offset filters
- The cfilters file
- Lab exercises and case studies
Display filters
- Ways to configure display filters
- Simple and structured filters
- Focusing on protocol and text strings
- The dfilters file
- Lab exercises and case studies
Using basic statistics tools
- Capture file properties
- Resolved addresses properties
- Protocol hierarchies
- Endpoint and conversation statistics
- Protocols statistics
- Lab exercises and case studies
Using smart statistics tools
- Create basic and advanced I/O graphs
- Create TCP Time-Sequence graphs
- Analyze flow graphs
- Evaluate service response times
- Create Round-Trip-Time graphs
- Analyze TCP/IP flows
- Analyse applications flows
- Lab exercises and case studies
The Expert System Basics
- The Expert-Infos window and how to use it for network troubleshooting
- Error events and understanding them
- Warnings events and understanding them
- Notes events and understanding them
- Lab exercises and case studies
CLI and Tshark/TCPDump
- Working with CLI tools
- Working with Linux and TCPDump
- How to use Syntax and filters
- Buffers and optimization
- Ways to save capture files
- Wireshark for Linux
IPv4 analysis
- IPv4 principles of operation and packet structure: duplicate addresses, routing issues, fragmentation
- ICMPv4 – protocol operation, analysis and troubleshooting
- IPv4 ARP – operation and troubleshooting
- DHCP analysis
- Lab exercises and case studies
TCP/UDP analysis
- L4 connectivity
- L4 operations
- Connectivity and reliability
- Well known ports
- UDP principles and packet structure
- UDP Basics and frame structure
- UDP operation
- TCP principles and packet structure
- TCP principles, packet structure and state machine
- The Sliding Windows mechanism and window size changes
- Ack frequency, delayed Ack and the Nagel algorithm
- Slow start, flow and congestion control
- TCP enhancements: Selective Ack, Time stamps, scale factor and more
- The TCP chimney offload mechanism
- Bandwidth/throughput and delay issues
- Lab exercises and case studies
Packet Loss, Delay, Jitter and Retransmissions
- Packet loss and recovery – UDP and TCP
- Previous segment lost and Out-of-Order Segments events
- Duplicate ACKs and Fast Retransmissions
- TCP Retransmissions and their impact on network performance
- Delay/jitter influence on TCP behaviour
- Zero window, Window changes and other window problems
- Lab exercises and case studies
DNS Traffic Analysis
- DNS, MDNS and Secured DNS (DNSsec) – the theory
- IPv4 and IPv6 record types
- Normal and suspicious behavior of DNS
- How to isolate unusual behavior of DNS
- Configuring smart DNS filters
- DNS performance issues
- Lab exercises and case studies
HTTPv1/2 Traffic analysis, including Fiddler
- HTTP operation and message structure
- HTTP request methods and statues codes
- Analyses HTTP streams: normal operation and problems
- How to watch HTTP statistics
- How to export HTTP objects
- Analyzing HTTPs communications
- Packet analysis and troubleshooting
- Lab exercises and case studies
FTP Traffic Analysis
- FTP/FTPs principles of operation
- Active and passive FTP
- FTP performance and how to locate performance problems
- Lab exercises and case studies
Enterprise Applications Analysis and Troubleshooting
- MS-Terminal and Citrix operation and troubleshooting
- SMB/CIFS operation and analysis
- DCS/RPC operation and analysis
- Database applications analysis (from the network point of view)
- Lab exercises and case studies
SIP, IPT and Streaming applications
- IP telephony principles of operations
- SIP principles of operations, messages and error codes
- RTP, RTCP and media transfer
- Video over IP and RTSP
- Normal operation and what might get wrong
- Wireshark features for IPT – SIP, VoIP Calls, RTP, RTSP
- Capture and display filters for IPT and multimedia
- Wireshark features for IPT – RTP session parameters and stream analysis, filters and RTP playback feature
- Lab exercises and case studies
Network Security and Forensics
- Gather information – what to look for
- Unusual traffic patterns
- Complementary tools
- MAC and IP address spoofing
- Attacks signatures and signature locations
- ARP poisoning
- Header and sequencing signatures
- Attacks and exploits
- TCP splicing and unusual traffic
- DoS and DDoS Attacks
- Protocol scans
- DNS-based attacks
- Find maliciously malformed packets
- Lab exercises and case studies
Wireshark software architecture and additional tools
- Wireshark application architecture
- Software applications and tools
- Merge and splitCAP
- Tools and methods for massive packet capture
- DNS, HTTP, SIP/IPT and specific protocol tools
- Lab exercises and case studies
Writing smart capture applications
- Conditional triggering of capture
- Deeper look in to capture filters
- Using Python for smart inspection and analysis
- Performing and synchronizing capture on multiple sources
- Lab exercises and case studies
Labs
- Configuring packet capture on single and multiple interfaces
- Using navigation and colouring techniques
- Using time values
- Configuring L2/L3/L4 name resolution
- Saving, importing and exporting files
- Configuring user interface and global preferences
- Configuring basic capture filters and the cfilters file
- Configuring structured and offset capture filters
- Configuring basic L2/3/4 display filters and the dfilters file
- Locate text-strings in a capture file
- Using basic statistics tools for IP and UDP/TCP traffic analysis
- Find the top talkers and protocols on a Network
- Working with IO graphs for traffic analysis
- Using IO graphs for bandwidth and throughput analysis
- Using IO graphs with display filters
- Using the Expert-Infos to find network issue
- Working with CLI and Scripting tools
- Analysing ARP traffic and ARP problems
- Understanding normal UDP and TCP behaviour
- Resolving TCP retransmission problems
- TCP Duplicate ACKs and Fast retransmissions problems
- TCP resets and why they happen
- TCP zero-window and window changes and why they happen
- Determine the cause for slow applications
- Delays and how they influence applications
- Use TCP stream graphs to analyse TCP behaviour
- Analysing packet losses, where they come from and why
- Using the Expert Infos to find application events
- TCP performance issues
- TCP delay/jitter calculations
- TCP timestamps, scale factor and selective ACKs
- Analysing SIP connectivity problems
- Analyse SSL/TLS connectivity
- Analysing DNS problems
- Analysing DNS performance problems
- Analysing FTP connectivity issues
- Analysing HTTP connectivity
- Analysing HTTP performance issues
- SIP connectivity problems
- Degradation in voice quality
- Video freezes analysis
- Unusual traffic patterns
- DDoS attack patterns
- DNS Attacks
- Case studies and challenges
- Writing shell scripts with Wireshark
- Writing Python statistics and search tools
