TCP/IP Network Traffic Analysis and Troubleshooting with Wireshark

Course Outline

This two-day course introduces participants to the fundamental principles of packet network analysis using Wireshark – the world’s most widely used network analyzer. It covers, in detail, the essential elements and features of Wireshark.

The course begins with a review of key concepts and the formalism of the ISO/OSI reference model (ITU-T X.200) to facilitate more effective, layer-by-layer troubleshooting, alongside the TCP/IP protocol suite. A core part of the training focuses on methods and best practices for packet capturing and offline traffic analysis. The goal of the analysis is to:

• identify and resolve issues related to specific services and protocols,
• verify communication between peers at each OSI layer,
• and proactively detect and prevent potential problems.

In-depth lectures are supported by numerous examples and practical exercises based on sample capture files containing real-world network traffic patterns. Participants are expected to have a basic understanding of modern computer networks.

Objectives

• Develop a strong understanding of the basic terminology and components of the ISO/OSI reference model and TCP/IP protocol suite, and apply this knowledge to real-world problem solving.
• Build a solid foundation in packet network analysis and troubleshooting using Wireshark.
• Understand the capabilities and limitations of Wireshark, including packet capture processes, traffic filtering mechanisms (capture vs. display filters), and protocol-specific features.
• Learn to efficiently use Wireshark to identify the root causes of network performance issues.
• Gain insight into user-level application behavior through network traffic analysis.

Prerequisite Knowledge

1. Basic familiarity with modern computer networks, including a foundational understanding of layered network principles and architectures such as TCP/IP.

2. Operational knowledge of Unix/Linux operating systems, including:

• Using the terminal
• Understanding the directory structure
• Listing files and directories
• Creating and changing directories
• Copying, moving, and deleting files and directories
• Using redirection and pipes
• Managing processes (e.g., listing suspended and background processes)

Minimum Hardware Requirements

1. Processor: Dual-core modern processor, 3 GHz, with at least 4 MB cache.

2. RAM: Minimum 6 GB.

3. Disk Space: At least 20 GB of free space on the OS partition, plus an additional 20 GB of free space on any partition. This requirement excludes the operating system and refers to the space needed before installing the additional software.

Software Requirements

1. Operating System: Ubuntu Linux is preferred. The following command-line tools should be installed: ip, iperf, and ipcalc.

2. Wireshark: Install the latest stable version, available at https://www.wireshark.org/download.html.

3. FTP Client: Any FTP client of your choice.

 

All applications should be installed in their latest stable available versions.