TCP/IP Network Traffic Analysis and Troubleshooting with Wireshark

Characteristics

This two-day course introduces participants to the fundamental principles of network packet analysis using Wireshark – the world's most popular network analyzer. It covers the essential elements and features of Wireshark in detail.

The course begins with an overview of key concepts and the formalism of the ISO/OSI reference model (ITU-T X.200) to facilitate more effective, layer-by-layer troubleshooting, along with an overview of the TCP/IP protocol suite. The main part of the course focuses on methods and best practices for packet capturing and offline traffic analysis.

The goal of the analysis is to:

• identify and troubleshoot issues related to specific services and protocols
• verify node-to-node communication at each OSI layer
• and proactively detect and prevent potential issues

Detailed lectures are supported by numerous examples and practical exercises based on sample capture files containing real network traffic patterns. Participants should have a basic knowledge of modern computer networks.

Target Audience

The course is designed for students and IT professionals, customer service engineers, application support engineers, and network engineers who:

• need to develop essential network packet analysis and troubleshooting skills, including diagnosing problems across all OSI layers (e.g., high latency, packet loss, limited bandwidth)
• want to understand practical and effective network analysis techniques

Fundamentals of Network Analysis and the ISO/OSI Model

• Review of the ISO/OSI reference model assumptions and the TCP/IP protocol stack.
• How to translate network model theory into effective troubleshooting of real-world failures.
• The role of a packet analyzer in the daily work of an engineer.

Wireshark Environment – Capabilities and Configuration

• Architecture, capabilities, and limitations of the Wireshark tool.
• Processes for proper packet capturing in various network topologies.
• Working with filters: Capture Filters vs. Display Filters.
• Personalization of the interface and features specific to the analyzed protocols.

Traffic Analysis and Application Behavior

• Analyzing application behavior at the user level based on network traffic.
• Examining packet structure and verifying communication between nodes.
• Working with capture files (offline analysis) – reading and interpreting network traces.

Diagnostics and Troubleshooting

• Identifying common network performance issues (packet loss, retransmissions, bottlenecks).
• Analyzing latency and throughput limits using Wireshark charts and statistics.
• Quickly locating the source of a failure based on layer-by-layer analysis.

Practical Workshops (Labs)

Independent analysis of real, simulated, and production capture files under the guidance of a trainer. Step-by-step troubleshooting of real-world failure scenarios.