Going deeper in Wireshark: expert info and TCP analysis
With Wireshark’s expert info, IO graphs, Decode As and TCP analysis flags you explain slowness, loss and odd behaviour with evidence.
Level 201 · 16 lessons · 18 practice labs
Lessons
Workspace
- Wireshark profiles: a workspace per job
- Custom columns and applying fields as columns
- Time display, time references and packet deltas
- Using name resolution and GeoIP fields deliberately
- Short task: build your own profile for incident review
TCP analysis
- Expert info: warnings, notes and errors
- Retransmissions, duplicate ACKs and lost segments
- Zero window and window full: finding the slow receiver
- TCP stream graphs: Stevens, throughput and RTT
- Short task: prove whether the network or the server is to blame in a slow download
Dissection and visualisation
- Decode As: dissecting a protocol on a non-standard port
- IO graphs: seeing spikes and periodic traffic
- Reading a conversation on a timeline with the flow graph
- Packet comments and keeping findings in the file
- Short task: find the host that connects at a steady interval on a graph
- Capstone: explain an “the app is slow” complaint with packets
Practice labs
- Build an incident review profile: Build and save a profile with source port, SNI and stream number columns.
- Measure gaps with a time reference: Set a request as time reference and measure how long after it the response arrives.
- A capture where name resolution misleads: Find traffic shown under the wrong service name with name resolution on and prove the real protocol.
- Count the warnings in expert information: Pull the warning types and counts in the capture from the expert information window.
- Zero window: the slow receiver: Find the side advertising zero window and measure how long the transfer stalled.
- Is the network or the server to blame: Prove with packets whether the delay in a slow download comes from the network or the server.
- A non-standard port with Decode As: Decode traffic on a non-standard port with the right protocol and read its contents.
- A host connecting at regular intervals: Find the connection that repeats at regular intervals in the I/O graph and measure the interval.
- Explain an app-is-slow complaint: Explain the cause of slowness in the Karaçam Mobilya accounting app's capture with packets and write a short note.
- Apply a field as a column: Turn the HTTP host field into a column and find the name receiving the most requests.
- An inter-packet time column: Add a column for time since the previous packet and find the longest silence.
- Read a conversation with the flow graph: In a capture carrying three interleaved sessions, separate them with the flow graph and show on the timeline where one stalls and is cut short.
- Find the retransmissions: Filter retransmitted segments in a download capture and say in which direction they cluster.
- Delay from the RTT graph: Find the moment delay rises from the round-trip time graph.
- Loss or reordering: Separate retransmission, duplicate ACK and out-of-order warnings to prove whether the capture shows real packet loss or reordering.
- Add a comment to a packet: Add comments to three evidence packets and confirm the comments are stored in the file.
- Mark and export the evidence packets: Mark five evidence packets, export only the marked ones to a new file and confirm the comments are kept.
- A findings note from an annotated evidence file: Add file and packet comments, take the comment listing from the capture file properties and turn it into a findings note another analyst can follow.
About this course
With Wireshark’s expert info, IO graphs, Decode As and TCP analysis flags you explain slowness, loss and odd behaviour with evidence.
What you will learn
- Workspace
- TCP analysis
- Dissection and visualisation
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.