Wireshark – Advanced Training
More Complex Cases: Performance, Troubleshooting, and Security Through Real-World Case Studies
.svg)
Machine Learning Engineer
1. Methodological Troubleshooting
- A quick knowledge check and targeted review.
- Record the initial conditions, network diagram, and measurement conditions.
- Select relevant connections and structure an investigation in a logical way.
2. Advanced Connection Analysis
- Examine more complex communication problems.
- Understand the interaction between end systems, applications, and intermediate components.
- Verify any abnormalities based on additional observations.
3. Performance Case Studies
- Evaluate timing behavior, transmission performance, and protocol sequences together.
- Identify potential bottlenecks and compare different explanations.
- Link statistics and charts specifically to package details.
4. Multipoint Analysis
- Compare recordings from multiple measurement points.
- Assign related packages and communication segments.
- Take into account differences in the records and verify the reliability of statements regarding time.
5. Security and Additional Case Studies
- Examine safety-related aspects of connections and the behavior of safety components.
- Evaluate encrypted communication based on the available information.
- Additional security case study, depending on the group's interests.
6. Independent Analysis and Presentation of Results
- Work on advanced cases with progressively less guidance.
- Record your own hypotheses, counterevidence, and remaining uncertainties.
- Discuss the results and determine appropriate next steps.
- You develop specific analytical questions based on a problem description.
- You analyze more complex communication processes in a structured manner.
- You troubleshoot performance issues based on timing, throughput, and protocol sequences.
- You use multiple data points to test hypotheses.
- You evaluate safety-related observations in the context of communication.
- You document findings, alternative explanations, and open questions in a clear and transparent manner.
After a brief knowledge check, you will first work on selected cases independently or in small groups. Targeted guidance is provided as needed; the group discussion follows after you have worked on the cases on your own. You will justify your hypotheses, look for counterevidence, and compare different approaches to solving the problems. Short theory sessions explain the necessary protocol mechanisms.
The case studies cover performance, troubleshooting, multipoint analysis, security, and advanced analysis tasks—a selection tailored to the group’s level of knowledge will be compiled for the two-day session. The course materials also include a detailed section on Ethernet and ARP, IP and ICMP, TCP, UDP, and DHCP, as well as selected application protocols such as DNS, HTTP, and TLS—the training will delve deeper into the topics relevant to the case studies, while the rest is available for reference.
Subject to prior approval, a suitable recording you have made yourself may be used in place of a prepared case (optional; it must be approved and edited to remove any confidential content).
Prerequisites: We recommend that participants have previously completed the Wireshark Basics training; however, participants with comparable practical experience may also enroll. Participants must be familiar with display filters, streams, columns, and statistics, and have a basic understanding of TCP communication.
Technical Requirements: A computer with a stable version of Wireshark installed.
- Network and System Administrators
- Application administrators and technical support staff with basic experience using Wireshark
.svg)