J. S., Framestore CFC
B. M., London Internet Exchange
IS-IS training course contents
What is Wireshark?
Protocol analysers, Wireshark features, Wireshark versions, troubleshooting techniques with Wireshark.
Downloading Wireshark, UNIX issues, Microsoft issues, the role of winpcap, promiscuous mode, installing Wireshark. Wireshark documentation and help.
Hands on: Downloading and installing Wireshark.
Starting and stopping basic packet captures, the packet list pane, packet details pane, packet bytes pane, interfaces, using Wireshark in a switched architecture.
Hands on: Capturing packets with Wireshark.
Troubleshooting networks with Wireshark
Common packet flows.
Hands on: Analysing a variety of problems with Wireshark.
Capture filter expressions, capture filter examples (host, port, network, protocol, worm), primitives, combining primitives, payload matching.
Hands on: Configuring capture filters.
Applying and clearing filters. Protocol, fields, addresses, frames containing strings. Filter comparisons. Combining filters. Finding packets, marking packets.
Hands on: Configuring display filters.
Working with captured packets
Live packet capture, saving to a file, capture file formats, reading capture files from other analysers, merging capture files, finding packets, going to a specific packet, display filters, display filter expressions.
Hands on: Saving captured data, configuring display filters.
Analysis and statistics with Wireshark
Enabling/disabling protocols, user specified decodes, following TCP streams, protocol statistics, conversation lists, endpoint lists, I/O graphs, protocol specific statistics.
Hands on: Using the analysis and statistics menus.
Command line tools
Tshark, tethereal, capinfos, editcap, mergecap, text2pcap, idl2eth.
Hands on: Using tshark.
802.11 issues, management frames, monitor mode, packet reassembling, name resolution, customising Wireshark.
Hands on: Customising name resolution.
Why Choose Us
SNT trainers score an average of over 90% on the three main areas of:
- Ability to teach
- Technical knowledge
- Answering questions
We limit our maximum class size to 8 delegates; often we have less than this. This ensures optimal interactivity between delegates and instructor.
"Excellent course. The small class size was a great benefit…" M.B. IBM
We write our own courses; courseware does not just consist of slides and our slides are diagrams not bullet point text. A typical chapter provides clearly defined objectives with a chapter overview, slides with text underneath, a quiz at the end to check the learning of the students. Hands on exercises are at the end and are used to reinforce the theory.