{"$schema": "https://c3voc.de/schedule/schema.json", "generator": {"name": "pretalx", "version": "2026.2.1", "url": "https://conference.wireshark.org"}, "schedule": {"url": "https://conference.wireshark.org/sf26eu/schedule/", "version": "0.30", "base_url": "https://conference.wireshark.org", "conference": {"acronym": "sf26eu", "title": "SharkFest'26 Europe", "start": "2026-11-02", "end": "2026-11-06", "daysCount": 5, "timeslot_duration": "00:05", "time_zone_name": "Europe/Brussels", "colors": {"primary": "#672fc6"}, "rooms": [{"name": "Room 1", "slug": "13-room-1", "guid": "f2d5f438-0ec5-592d-a452-3486ec96a598", "description": "Plenary Room", "capacity": null}, {"name": "Room 2", "slug": "14-room-2", "guid": "6c63354c-b4d7-52ad-a001-8d929914b1c3", "description": "2nd Session Room", "capacity": 80}, {"name": "Room 3", "slug": "18-room-3", "guid": "d47d9594-fc8a-5a63-b8a0-d33007432503", "description": null, "capacity": null}], "tracks": [{"name": "Beginner", "slug": "37-beginner", "color": "#00AB9B"}, {"name": "Intermediate", "slug": "38-intermediate", "color": "#2B9ECF"}, {"name": "Expert / Developer", "slug": "39-expert-developer", "color": "#9D6DEC"}, {"name": "Security", "slug": "40-security", "color": "#72B406"}, {"name": "A.I.", "slug": "41-ai", "color": "#E60757"}, {"name": "Pre-conference class", "slug": "42-pre-conference-class", "color": "#0C590D"}, {"name": "Organization", "slug": "43-organization", "color": "#3C8BC4"}], "days": [{"index": 1, "date": "2026-11-02", "day_start": "2026-11-02T04:00:00+01:00", "day_end": "2026-11-03T03:59:00+01:00", "rooms": {"Room 1": [{"guid": "033728d5-506c-551c-928f-b41dfcd4902a", "code": "7JUZMZ", "id": 212, "logo": null, "date": "2026-11-02T09:00:00+01:00", "start": "09:00", "end": "2026-11-02T17:00:00+01:00", "duration": "08:00", "room": "Room 1", "slug": "sf26eu-212-0-pre-conference-class-i-practical-wireshark-skills-for-it-professionals", "url": "https://conference.wireshark.org/sf26eu/talk/7JUZMZ/", "title": "Pre-Conference Class I: Practical Wireshark Skills for IT professionals", "subtitle": "", "track": "Pre-conference class", "type": "Pre Conference Class", "language": "en", "abstract": "**Hands on Wireshark Lab and Wireshark Certified Analyst Prep**\n\nPractical Wireshark Troubleshooting is a two-day, hands-on course designed to strengthen your packet analysis and troubleshooting skills. On Day 1, Ross Bagurdes guides you through Wireshark\u2019s key features, capture methods, filtering techniques, and foundational protocols at the Data Link and Network layers. On Day 2, Chris Greer takes you deeper into Transport and Application layer analysis, focusing on TCP, UDP, and the tools that uncover real-world performance problems. By the end, you\u2019ll know how to approach network issues with confidence \u2014 and be better prepared for the Wireshark Certified Analyst exam.", "description": "Level up your Wireshark skills and get ready for Sharkfest! This hands-on course will provide core Wireshark skills for IT pros of all experience levels. Participants will gain a solid understanding of how to use Wireshark to capture, analyze, and troubleshoot network traffic. The course is designed with beginners in mind, but even seasoned packet people will pick up new tips and tricks.", "recording_license": "", "do_not_record": true, "persons": [{"code": "KDQCGV", "name": "Ross Bagurdes", "avatar": null, "biography": null, "public_name": "Ross Bagurdes", "guid": "d1f5bd15-bc78-562b-8d72-5f7d2a6d9a8d", "url": "https://conference.wireshark.org/sf26eu/speaker/KDQCGV/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/7JUZMZ/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/7JUZMZ/", "attachments": []}], "Room 2": [{"guid": "ec9cba51-0682-543e-a3b9-cde67efbd080", "code": "7TVPHQ", "id": 209, "logo": null, "date": "2026-11-02T09:00:00+01:00", "start": "09:00", "end": "2026-11-02T17:00:00+01:00", "duration": "08:00", "room": "Room 2", "slug": "sf26eu-209-pre-conference-class-ii-webrtc-network-analysis-masterclass", "url": "https://conference.wireshark.org/sf26eu/talk/7TVPHQ/", "title": "Pre-Conference Class II: WebRTC Network Analysis Masterclass", "subtitle": "", "track": "Intermediate", "type": "Pre Conference Class", "language": "en", "abstract": "If you have users complaining about audio issues in their Teams/Meet/Zoom calls and need to find out the reason.\n\n- If you need to configure your network perimeter to optimally support WebRTC traffic under specific regulations\n\n->  this class is for you.\n\n**Goal**\n After this class you will be able to take a capture of a WebRTC Web Conferencing call,\n analyze the salient call components for potential problems and implement the required \nmeasures in your network perimeters to overcome such problems.\n\nAfter a general introduction of WebRTC we will show the use of AI tools for a quick start, and then dive into the packets.\n \nThere will be prepared captures, and a live capture sessions -  but you can also bring our \nown captures or capture with your specific Web conferencing tool (as long as it uses WebRTC)", "description": "## Agenda\n \nWhich products use WebRTC and how are they different\n\t \n**Call setup in a nutshell** \n(explained with a capture - we use one very typical capture throughout the course)\n\n- What happens before WebRTC kicks in (Signaling, SDP)\n- Connectivity detection ICE/STUN/TURN\n- What can I optimize on client side (restrict candidates)\n\n\t \n**Analyzing the capture**\n\n- What AI can tell us about the capture\n- Go through the setup packet by packet and check the media flows\n\n \n**Media Performance**\n\n- UDP vs TCP\n- Packet loss & delay in a worldwide network\n\n \n**Doing a live capture**\n\n- Decrypt signaling\n- Check a few selected captures\n\n \n**The nasty stuff (and how to deal with it)**\n\n- Packet filters\n- Proxies & Zscaler\n- VPN & SDWAN\n- Reconnect times\n- TURN servers\n\n**What's the difference in how the various products use WebRTC**\nTeams\nZoom\nWebex\nGotoMeeting\nGoogle Meet", "recording_license": "", "do_not_record": true, "persons": [{"code": "Z3HPBS", "name": "Robert Hess", "avatar": "https://conference.wireshark.org/media/avatars/GEKGFS_717UcZg.jpg", "biography": "Helping customers and engineers to understand problems with communication protocols in their networks.\nDebugging communication protocols and analyzing log files for a living and having fun with it.\nFinding problems in software since the era of punched tapes.\nCurrently Freelance", "public_name": "Robert Hess", "guid": "1768450f-d7d1-5e98-9184-23a51840bef5", "url": "https://conference.wireshark.org/sf26eu/speaker/Z3HPBS/"}, {"code": "YNLUZL", "name": "Alexander Muellrr", "avatar": null, "biography": null, "public_name": "Alexander Muellrr", "guid": "51622ef0-fd32-561b-a4db-de77ce0010af", "url": "https://conference.wireshark.org/sf26eu/speaker/YNLUZL/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/7TVPHQ/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/7TVPHQ/", "attachments": []}], "Room 3": [{"guid": "0c2d20f5-898c-55ac-975f-a5267756e5c6", "code": "VKPWM3", "id": 268, "logo": null, "date": "2026-11-02T09:00:00+01:00", "start": "09:00", "end": "2026-11-02T17:00:00+01:00", "duration": "08:00", "room": "Room 3", "slug": "sf26eu-268-0-pre-conference-class-iv-smb-masterclass", "url": "https://conference.wireshark.org/sf26eu/talk/VKPWM3/", "title": "Pre-conference class IV: SMB Masterclass", "subtitle": "", "track": "Pre-conference class", "type": "Pre Conference Class", "language": "en", "abstract": "SMB is the bread and butter protocol used to access file shares in virtually every company and home network. Since Windows Vista / Server 2008, the \"classic\" SMB has been replaced by SMB2 and later SMB3. As legacy systems running Windows XP / Server 2003 are increasingly rare, we focus on the newer version.\n\nBased on student feedback the class from 2025 is now offered as a 2 day class. The 2 day format allows more time for practical exercises.", "description": "This class will enable students to investigate functional issues and performance problems. Topics covered are\n\n* SMB Handshake, selection of a dialect version and user authentication\n* General process of mounting a share and accessing files\n* Tracking SMB sessions over multiple interfaces or IP-addresses\n* Investigating error codes\n* Decryption of SMB traffic (not for the faint-hearted)\n* The role of Kerberos in authentication, encryption and Wireshark-based decryption\n* Understanding the service response time feature for SMB\n* Baselining application behavior for SMB file access\n* identification of performance bottlenecks in the network, application logic, client or server\n* SMB functions beyond file sharing (IPC, Named Pipes)\n* Identificaiton of malicious named pipes, that could be used for malware control\n\nHere is, what previous students say about the class:\n\n- Great class, good walk throu of SMB troubleshooting. I enjoyed it very much. Made a lot of things i struggled with earlier a lot clearer to me.\n- It was fantastic! I now definitely have a better overview over what SMB is doing.\n- Great and awesome deep dive!!!", "recording_license": "", "do_not_record": true, "persons": [{"code": "GBVNGC", "name": "Eddi Blenkers", "avatar": null, "biography": "For over 20 years, Eddi has been looking at network protocols to find (or rule out) network problems, vulnerabilities, ongoing hacking attacks or just for fun.\n\nWorking for the Swiss train company BLS as IT security analyst, he is reviewing the configuration of a multitude of systems to improve the overall security of the domain. Wireshark is one of the tools to verify the outcome of a configuration change.\n\nShameless promotion: Visit https://www.bls.ch/en/freizeit-und-ferien/ausflug to find some of the best destinations in Switzerland.", "public_name": "Eddi Blenkers", "guid": "bd1f4309-a7a1-5b26-8d54-3e05eb4658eb", "url": "https://conference.wireshark.org/sf26eu/speaker/GBVNGC/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/VKPWM3/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/VKPWM3/", "attachments": []}]}}, {"index": 2, "date": "2026-11-03", "day_start": "2026-11-03T04:00:00+01:00", "day_end": "2026-11-04T03:59:00+01:00", "rooms": {"Room 1": [{"guid": "44e9b292-6353-5043-8993-83f8acaea51a", "code": "7JUZMZ", "id": 212, "logo": null, "date": "2026-11-03T09:00:00+01:00", "start": "09:00", "end": "2026-11-03T17:00:00+01:00", "duration": "08:00", "room": "Room 1", "slug": "sf26eu-212-1-pre-conference-class-i-practical-wireshark-skills-for-it-professionals", "url": "https://conference.wireshark.org/sf26eu/talk/7JUZMZ/", "title": "Pre-Conference Class I: Practical Wireshark Skills for IT professionals", "subtitle": "", "track": "Pre-conference class", "type": "Pre Conference Class", "language": "en", "abstract": "**Hands on Wireshark Lab and Wireshark Certified Analyst Prep**\n\nPractical Wireshark Troubleshooting is a two-day, hands-on course designed to strengthen your packet analysis and troubleshooting skills. On Day 1, Ross Bagurdes guides you through Wireshark\u2019s key features, capture methods, filtering techniques, and foundational protocols at the Data Link and Network layers. On Day 2, Chris Greer takes you deeper into Transport and Application layer analysis, focusing on TCP, UDP, and the tools that uncover real-world performance problems. By the end, you\u2019ll know how to approach network issues with confidence \u2014 and be better prepared for the Wireshark Certified Analyst exam.", "description": "Level up your Wireshark skills and get ready for Sharkfest! This hands-on course will provide core Wireshark skills for IT pros of all experience levels. Participants will gain a solid understanding of how to use Wireshark to capture, analyze, and troubleshoot network traffic. The course is designed with beginners in mind, but even seasoned packet people will pick up new tips and tricks.", "recording_license": "", "do_not_record": true, "persons": [{"code": "KDQCGV", "name": "Ross Bagurdes", "avatar": null, "biography": null, "public_name": "Ross Bagurdes", "guid": "d1f5bd15-bc78-562b-8d72-5f7d2a6d9a8d", "url": "https://conference.wireshark.org/sf26eu/speaker/KDQCGV/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/7JUZMZ/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/7JUZMZ/", "attachments": []}, {"guid": "6d0d06eb-e79f-588d-adf2-097dcde63ebe", "code": "XBMHVL", "id": 213, "logo": null, "date": "2026-11-03T17:30:00+01:00", "start": "17:30", "end": "2026-11-03T20:30:00+01:00", "duration": "03:00", "room": "Room 1", "slug": "sf26eu-213-sharkfest-26-europe-welcome-dinner-sponsor-showcase", "url": "https://conference.wireshark.org/sf26eu/talk/XBMHVL/", "title": "SharkFest'26 EUROPE Welcome Dinner & Sponsor Showcase", "subtitle": "", "track": "Organization", "type": "Dinner", "language": "en", "abstract": "Let's kick-off the conference in style!", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/XBMHVL/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/XBMHVL/", "attachments": []}], "Room 2": [{"guid": "410f1b6f-2942-5822-9fb2-d80271aa2a40", "code": "3PDG9V", "id": 211, "logo": null, "date": "2026-11-03T09:00:00+01:00", "start": "09:00", "end": "2026-11-03T17:00:00+01:00", "duration": "08:00", "room": "Room 2", "slug": "sf26eu-211-pre-conference-class-iii-the-proof-is-in-the-packets-network-threat-detection-using-wireshark", "url": "https://conference.wireshark.org/sf26eu/talk/3PDG9V/", "title": "Pre-Conference Class III: The Proof is in the Packets: Network Threat Detection Using Wireshark", "subtitle": "", "track": "Security", "type": "Pre Conference Class", "language": "en", "abstract": "In a world of encrypted traffic and sophisticated evasion, the network remains the ultimate source of truth. Security tools may alert you that something is wrong, but the packets tell you exactly what happened on the wire.\n\nThis intensive one-day training transforms Wireshark from a simple troubleshooting tool into a powerful forensic engine. We move beyond basic protocol analysis to focus on the indicators of compromise (IoCs) and threat actor behavior hidden in plain sight. Participants will learn how to identify the subtle \"heartbeats\" of malware, recognize command and control (C2) patterns, and dissect behavior at various stages of an attack. \n\nThrough hands-on labs using real-world pcap datasets, we will cover:\n\nExpert Filtering: Crafting security-focused display filters to cut through the noise.\n\nBehavioral Analysis: Identifying anomalies in TCP/IP handshakes and DNS queries.\n\nActionable Reporting: Extracting evidence to build an irrefutable \"proof of packet\" case.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "7EMVDQ", "name": "Marcelle Lee", "avatar": null, "biography": "Marcelle brings over twelve years of experience in cybersecurity, and her journey has taken her through some of the most elite teams in the field, including Secureworks Counter Threat Unit (CTU) and the Equinix Threat Analysis Center (ETAC). She's a security consultant, threat researcher, educator, and intel analyst with deep expertise in cyber threat intelligence, digital forensics, intrusion analysis, security operations, and technical writing.\n\nShe has contributed to both government and private sector initiatives, bringing a well-rounded perspective to cyber defense and threat research. Before transitioning into cybersecurity, Marcelle led operations and managed complex projects across various industries.\n\nA frequent speaker at conferences and training events, Marcelle is deeply committed to advancing the cybersecurity field and empowering the next generation of professionals.", "public_name": "Marcelle Lee", "guid": "8e7df401-8a9d-5896-863e-e81f645836fe", "url": "https://conference.wireshark.org/sf26eu/speaker/7EMVDQ/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/3PDG9V/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/3PDG9V/", "attachments": []}], "Room 3": [{"guid": "8f1e6542-b453-58c5-a1a0-73dfffa61d0d", "code": "VKPWM3", "id": 268, "logo": null, "date": "2026-11-03T09:00:00+01:00", "start": "09:00", "end": "2026-11-03T17:00:00+01:00", "duration": "08:00", "room": "Room 3", "slug": "sf26eu-268-1-pre-conference-class-iv-smb-masterclass", "url": "https://conference.wireshark.org/sf26eu/talk/VKPWM3/", "title": "Pre-conference class IV: SMB Masterclass", "subtitle": "", "track": "Pre-conference class", "type": "Pre Conference Class", "language": "en", "abstract": "SMB is the bread and butter protocol used to access file shares in virtually every company and home network. Since Windows Vista / Server 2008, the \"classic\" SMB has been replaced by SMB2 and later SMB3. As legacy systems running Windows XP / Server 2003 are increasingly rare, we focus on the newer version.\n\nBased on student feedback the class from 2025 is now offered as a 2 day class. The 2 day format allows more time for practical exercises.", "description": "This class will enable students to investigate functional issues and performance problems. Topics covered are\n\n* SMB Handshake, selection of a dialect version and user authentication\n* General process of mounting a share and accessing files\n* Tracking SMB sessions over multiple interfaces or IP-addresses\n* Investigating error codes\n* Decryption of SMB traffic (not for the faint-hearted)\n* The role of Kerberos in authentication, encryption and Wireshark-based decryption\n* Understanding the service response time feature for SMB\n* Baselining application behavior for SMB file access\n* identification of performance bottlenecks in the network, application logic, client or server\n* SMB functions beyond file sharing (IPC, Named Pipes)\n* Identificaiton of malicious named pipes, that could be used for malware control\n\nHere is, what previous students say about the class:\n\n- Great class, good walk throu of SMB troubleshooting. I enjoyed it very much. Made a lot of things i struggled with earlier a lot clearer to me.\n- It was fantastic! I now definitely have a better overview over what SMB is doing.\n- Great and awesome deep dive!!!", "recording_license": "", "do_not_record": true, "persons": [{"code": "GBVNGC", "name": "Eddi Blenkers", "avatar": null, "biography": "For over 20 years, Eddi has been looking at network protocols to find (or rule out) network problems, vulnerabilities, ongoing hacking attacks or just for fun.\n\nWorking for the Swiss train company BLS as IT security analyst, he is reviewing the configuration of a multitude of systems to improve the overall security of the domain. Wireshark is one of the tools to verify the outcome of a configuration change.\n\nShameless promotion: Visit https://www.bls.ch/en/freizeit-und-ferien/ausflug to find some of the best destinations in Switzerland.", "public_name": "Eddi Blenkers", "guid": "bd1f4309-a7a1-5b26-8d54-3e05eb4658eb", "url": "https://conference.wireshark.org/sf26eu/speaker/GBVNGC/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/VKPWM3/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/VKPWM3/", "attachments": []}]}}, {"index": 3, "date": "2026-11-04", "day_start": "2026-11-04T04:00:00+01:00", "day_end": "2026-11-05T03:59:00+01:00", "rooms": {"Room 1": [{"guid": "7b7a10c6-0415-5c34-a28c-227281ffdabe", "code": "FH9DSQ", "id": 216, "logo": null, "date": "2026-11-04T09:00:00+01:00", "start": "09:00", "end": "2026-11-04T10:00:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-216-keynote-things-i-love-about-wireshark-and-maybe-a-couple-of-things-i-don-t", "url": "https://conference.wireshark.org/sf26eu/talk/FH9DSQ/", "title": "Keynote: Things I Love About Wireshark (and maybe a couple of things I don't)", "subtitle": "", "track": "Organization", "type": "Organization", "language": "en", "abstract": "Gerald Combs & Friends talk about the new developments over the past year", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/FH9DSQ/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/FH9DSQ/", "attachments": []}, {"guid": "57c11820-2b74-558a-b133-35c36e116f58", "code": "AHJB7N", "id": 245, "logo": null, "date": "2026-11-04T10:15:00+01:00", "start": "10:15", "end": "2026-11-04T11:15:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-245-packet-stories-2", "url": "https://conference.wireshark.org/sf26eu/talk/AHJB7N/", "title": "Packet stories #2", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "_The packet stories are back with a few new cases from my work as an independent troubleshooter!_\n\n**_To be the network or not to be the network, that's the question!_**\n\nThis is a question we face a lot. The network is blamed by default, but is it really the network. During this session a couple of real life cases will be presented. What was the problem, how was it analyzed, what can we learn about the process and off course the answer to the question: was it the network?", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "PXDFUJ", "name": "Sake Blok", "avatar": "https://conference.wireshark.org/media/avatars/profile-2025-400x400_hgdKmpu.png", "biography": "Sake has been analyzing packets for over 25 years. During his work, Sake started developing functionality for Wireshark while working with the analyzer in his day-to-day job. He also enhanced multiple protocol dissectors. In 2007, Sake joined the Wireshark Core Development team. In 2009, After working for a reseller of networking equipment for 8 years, he started the company SYN-bit to provide network analysis and training services to enterprises across Europe.", "public_name": "Sake Blok", "guid": "47d71e8b-c095-541f-8e0f-246c3adf6a12", "url": "https://conference.wireshark.org/sf26eu/speaker/PXDFUJ/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/AHJB7N/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/AHJB7N/", "attachments": []}, {"guid": "86c9b438-e579-50bd-895b-a13089aeb5f5", "code": "7ELU8V", "id": 282, "logo": null, "date": "2026-11-04T11:30:00+01:00", "start": "11:30", "end": "2026-11-04T12:30:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-282-packet-capture-basics-how-do-you-get-em", "url": "https://conference.wireshark.org/sf26eu/talk/7ELU8V/", "title": "Packet capture basics; how do you get 'em", "subtitle": "", "track": "Beginner", "type": "Presentation", "language": "en", "abstract": "We've all heard that Wireshark can do packet analysis. But how do you get these packets in the first place? Here we'll discuss some of the different ways packet capture actually works, to give you a deeper understanding of what you can expect to show up, and not show up, when you get to the packet analysis part. In the end, even if you don't follow all the technical details, you should have a much better grasp of the world of packet capture.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "JNC89Q", "name": "Jaap Keuter", "avatar": null, "biography": "After studying \"Telecommunications and computer systems\", I worked for a <a href=\"https://www.zdnet.com/home-and-office/networking/philips-business-communications/\">global PABX manufacturer</a> and now for <a href=\"https://www.aimvalley.com\">a company</a> that designs Ethernet switching and optical transmission systems, and <a href=\"https://www.technolution.com/prime/\">High Assurance solutions</a>, as an embedded software engineer. Along the way I started using what was then called Ethereal, enhancing it and providing bug fixes, which eventually lead me to becoming a core developer. \n\nBesides this I like to spend time in the air, either skydiving or flying sailplanes.", "public_name": "Jaap Keuter", "guid": "b1c7a77c-74ac-5866-a862-aa16c45da064", "url": "https://conference.wireshark.org/sf26eu/speaker/JNC89Q/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/7ELU8V/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/7ELU8V/", "attachments": []}, {"guid": "9c09f5f9-878c-5371-94e3-fb34295f9977", "code": "R9PZDM", "id": 238, "logo": null, "date": "2026-11-04T13:30:00+01:00", "start": "13:30", "end": "2026-11-04T14:30:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-238-transformers-in-the-wire-advanced-dpi-fingerprinting-for-ai-stealth-vpn-detection", "url": "https://conference.wireshark.org/sf26eu/talk/R9PZDM/", "title": "Transformers in the Wire: Advanced DPI Fingerprinting for AI/Stealth VPN Detection", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "At SharkFest '24, we introduced the fundamentals of open-source deep packet inspection (DPI) using nDPI. Since then, network adversaries and stealth VPN providers have significantly evolved, rendering traditional methods like JA4 insufficient against heavily obfuscated traffic. This 1-hour follow-up session is split into two core sections.\n- We explore advanced traffic fingerprinting techniques and demonstrate how to leverage Wireshark to capture, dissect, and label complex traffic streams.\n- We address what happens when fingerprinting fails against highly evasive network communications such as stealth VPNs and self-hosted AI/LLM traffic detection\n- Then we will show how Wireshark data feeds into a data pipeline to train Transformer-based AI models to unmask stealth VPN/AI traffic.\n- The session concludes with a live demonstration showcasing both advanced DPI extensions and the AI model detecting disguised traffic in real time.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "M7WHWC", "name": "Luca Deri", "avatar": null, "biography": "Luca Deri is the leader of the ntop project (www.ntop.org), aimed at developing an open-source monitoring platform for high-speed traffic analysis and cybersecurity. He worked for the University College of London and IBM Research, before receiving his PhD at the University of Berne with a thesis about software components for traffic monitoring applications. Well-known in the open-source and Linux community, he currently shares his time between the ntop project and the University of Pisa where he has been appointed as a lecturer in the CS department.", "public_name": "Luca Deri", "guid": "825c65da-7b4c-5bce-a870-65e372c9442f", "url": "https://conference.wireshark.org/sf26eu/speaker/M7WHWC/"}, {"code": "GQJXMJ", "name": "Daniele Sartiano", "avatar": null, "biography": null, "public_name": "Daniele Sartiano", "guid": "2cc328fc-0be4-543b-953f-c8383cf02557", "url": "https://conference.wireshark.org/sf26eu/speaker/GQJXMJ/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/R9PZDM/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/R9PZDM/", "attachments": []}, {"guid": "588181ec-3f99-52cd-a544-4fe13eb7de57", "code": "7TY7ZF", "id": 275, "logo": null, "date": "2026-11-04T14:45:00+01:00", "start": "14:45", "end": "2026-11-04T15:45:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-275-build-a-datacenter-on-your-laptop-an-introduction-and-realtime-examples-of-simulated-networks", "url": "https://conference.wireshark.org/sf26eu/talk/7TY7ZF/", "title": "Build a datacenter on your laptop - an introduction and realtime examples of simulated networks", "subtitle": "", "track": "Beginner", "type": "Presentation", "language": "en", "abstract": "Setting up a realistic network used to mean racks of hardware, an expensive license or a heavy VM appliance. Today a laptop is enough. This talk shows how to build complete, reproducible networks from a single YAML file with containerlab, and how to watch every packet in them live in Wireshark via Edgeshark, without installing anything beyond Docker and VS Code. Starting from an empty laptop, we deploy a small network with a client, DNS and a TLS web server, capture its traffic from any container interface, then turn it into a DHCP-driven setup and see what the protocol really does on the wire. The second half shows how the same setup becomes a training tool: faults are built into the lab on purpose, and trainees have to find them with Wireshark, the way they would in production.", "description": "A network lab no longer needs a rack or heavy VM appliances. With containerlab, a topology is a YAML file: nodes, links, addresses and startup commands, versioned in Git and deployed in seconds. Every node is a Linux container wired with veth pairs, so the traffic is real kernel networking \u2013 nothing simulated, everything open to packet analysis.\n\nBuild it: starting from a clean laptop with VS Code and Docker, we deploy a client, a DNS server and a TLS web server, look at what containerlab creates underneath, and hit the typical day-one traps: subnet clashes, devcontainer path issues, missing return routes.\n\nSee it: we compare four ways to capture inside containers, ending with Edgeshark, which lists every container interface in the browser and opens a live capture in your local Wireshark with one click. Live: DNS lookup, TCP handshake, a TLS Client Hello leaking the server name, and the same session decrypted with SSLKEYLOGFILE.\n\nEvolve it: the lab moves from static addresses to DHCP. We follow DISCOVER, OFFER, REQUEST and ACK and inspect the options up to Option 121 \u2013 and see that DHCP options are offers the client may ignore.\n\nTrain with it: each training scenario is a topology file with a deliberate fault \u2013 a missing route, an overridden resolver, an ignored DHCP option. Trainees get a symptom (\"the website doesn't load\") and work down to the cause with Wireshark. Every trainee gets an identical lab, resets take seconds, and the fix is a one-line change.\n\nTakeaways: a running multi-node network in minutes, a capture workflow for containers that feels local, a method for building troubleshooting trainings from version-controlled labs, and an honest look at where container networks differ from real hardware.\n\nFor network engineers, analysts and trainers who know Wireshark. No containerlab experience needed.", "recording_license": "", "do_not_record": false, "persons": [{"code": "38N3ZL", "name": "Roland Knall", "avatar": null, "biography": null, "public_name": "Roland Knall", "guid": "4901d52b-9ac3-54a1-8f8f-00795e1bd75d", "url": "https://conference.wireshark.org/sf26eu/speaker/38N3ZL/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/7TY7ZF/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/7TY7ZF/", "attachments": []}, {"guid": "0b1cad88-40a6-5c77-8983-82006dba8a16", "code": "SCBU9V", "id": 253, "logo": null, "date": "2026-11-04T16:00:00+01:00", "start": "16:00", "end": "2026-11-04T17:00:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-253-macsec-protocol-overview-and-analysis", "url": "https://conference.wireshark.org/sf26eu/talk/SCBU9V/", "title": "MACsec - Protocol overview and Analysis", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "Corporate networks are increasingly facing internal threats as well. As a result, there is a growing demand for the encryption of all packets transmitted between switches or between end devices and switches instead of only authentication at the beginning of a session. MACsec defined in 802.1AE can offer a solution in this area. Manufacturers are now increasingly offering MACsec-compatible components and since version 4.6, Wireshark has also provided advanced analysis functions through a specialised form of decryption.", "description": "MACsec was defined in 2006, but its prevalence has only been rising in recent years. It can provide Hop-by-Hop Encryption in Line-Rate between Switches or between Hosts and Switches. So analysts are looking for ways to analyze it. \n\nWe will provide an overview about MACsec and its use cases before we dive in to frame structure, key distribution concepts in conjunction with their decryption possibilities in Wireshark. We will go over some example captures and take a look how to analyze them.", "recording_license": "", "do_not_record": false, "persons": [{"code": "C7PRD8", "name": "Benjamin Pfister", "avatar": "https://conference.wireshark.org/media/avatars/CZKLHS_nNym8RM.jpg", "biography": "- Head of Networking and Telecommunication at City of Kassel\n- Author for several IT-Magazines (Heise, iX, IT-Administrator)\n- VoIP and Network Consultant\n- Freelance Trainer\n- System Administrator for Telecommunication and Networking at City of Kassel\n- Service Technician at Deutsche Telekom", "public_name": "Benjamin Pfister", "guid": "4f014a7a-632f-5d31-974a-41bc1c374adb", "url": "https://conference.wireshark.org/sf26eu/speaker/C7PRD8/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/SCBU9V/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/SCBU9V/", "attachments": []}, {"guid": "e353b159-dd04-5859-b87e-e0ff420a9c48", "code": "RKDKT7", "id": 267, "logo": null, "date": "2026-11-04T17:15:00+01:00", "start": "17:15", "end": "2026-11-04T18:15:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-267-from-user-to-developer", "url": "https://conference.wireshark.org/sf26eu/talk/RKDKT7/", "title": "From User to Developer", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "The story of how I came to develop in the Wireshark ecosystem after being a mere user for years and the lessons learned along the way.", "description": "Many of us are using Wireshark to retrieve and analyze network traces of communication between multiple elements of our network but while many protocols are already decoded out of the box, your particular one way not be known yet.\nThis talks walks you through the journey of such a user who took the matter in his hands to makes his life easier (and others\u2019 in the process) then found it pleasant enough to continue.", "recording_license": "", "do_not_record": true, "persons": [{"code": "BZRAJ9", "name": "Simon Papin", "avatar": null, "biography": "Writes software that talks to hardware.\nThen helps colleagues and customers understand why the device does respond the way (they think) it should.", "public_name": "Simon Papin", "guid": "06895807-99a1-52b2-a30d-4dac8aaeab4c", "url": "https://conference.wireshark.org/sf26eu/speaker/BZRAJ9/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/RKDKT7/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/RKDKT7/", "attachments": []}, {"guid": "42e6b8d6-a171-5a0e-9f58-48256c07fa72", "code": "PDW7AX", "id": 214, "logo": null, "date": "2026-11-04T18:30:00+01:00", "start": "18:30", "end": "2026-11-04T21:30:00+01:00", "duration": "03:00", "room": "Room 1", "slug": "sf26eu-214-sponsor-technology-showcase-reception-nerd-team-trivia-and-dinner", "url": "https://conference.wireshark.org/sf26eu/talk/PDW7AX/", "title": "Sponsor Technology Showcase Reception, Nerd Team Trivia and Dinner", "subtitle": "", "track": "Organization", "type": "Dinner", "language": "en", "abstract": "Sponsor Showcase and Dinner", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/PDW7AX/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/PDW7AX/", "attachments": []}], "Room 2": [{"guid": "ad0a025c-ffee-5e92-80c8-fd51aa955654", "code": "AX3RJX", "id": 236, "logo": null, "date": "2026-11-04T10:15:00+01:00", "start": "10:15", "end": "2026-11-04T11:15:00+01:00", "duration": "01:00", "room": "Room 2", "slug": "sf26eu-236-corporate-encryption-challenges", "url": "https://conference.wireshark.org/sf26eu/talk/AX3RJX/", "title": "Corporate encryption challenges", "subtitle": "", "track": "Expert / Developer", "type": "Presentation", "language": "en", "abstract": "Your company has a policy that all traffic over public internet should be Post Quantum Cryptography (PQC) ready. Or that for B2B communication Mutual-TLS (mTLS) is mandatory. How do you validate that the policy is correctly implemented?\nAnd check for performance improvements: wat is the ratio of resumed TLS sessions, is the TLS handshake unnecessarily large, is \u2018Hello Request\u2019 or is \u2018Early Data\u2019 used?\nIn this session we will cover the methods of analyzing using Wireshark. Even if decryption is not allowed or hard to do.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "9BZVZM", "name": "Andr\u00e9 Luyer", "avatar": "https://conference.wireshark.org/media/avatars/KZT9D7_Vb6QQqm.webp", "biography": "Andr\u00e9 is a senior Performance Consultant and troubleshooter at Rabobank, and has been analyzing packets for over 30 years. He started his career as a troubleshooter for network issues, both hard- and software, and later specialized in performance testing, which requires a combination of in-depth knowledge of networking protocols and coding skills. Andr\u00e9 also contributed to the Wireshark project.", "public_name": "Andr\u00e9 Luyer", "guid": "bfadb678-059c-54b4-aeb9-c9e3147178ee", "url": "https://conference.wireshark.org/sf26eu/speaker/9BZVZM/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/AX3RJX/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/AX3RJX/", "attachments": []}, {"guid": "2526b66c-887e-5350-91be-ee7271c5514c", "code": "CGU8JY", "id": 276, "logo": null, "date": "2026-11-04T11:30:00+01:00", "start": "11:30", "end": "2026-11-04T12:30:00+01:00", "duration": "01:00", "room": "Room 2", "slug": "sf26eu-276-tcp-details-that-matter-for-the-wca-exam", "url": "https://conference.wireshark.org/sf26eu/talk/CGU8JY/", "title": "TCP details that matter for the WCA Exam", "subtitle": "", "track": "Expert / Developer", "type": "Presentation", "language": "en", "abstract": "The Wireshark Certified Analyst exam is not an easy certification to take, especially if your knowledge about the details of the TCP protocol is somewhat shaky. In this talk we'll take a look at the aspects mentioned in the WCA curriculum and discuss them together. The goal is to make sure you understand what you need to bring to the exam and help you identify the areas where you might have to improve your skill analyzing TCP to achieve the WCA status.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "ZFQRPP", "name": "Jasper Bongertz", "avatar": null, "biography": null, "public_name": "Jasper Bongertz", "guid": "a9000fe3-d4d0-5e13-a7b1-425214071202", "url": "https://conference.wireshark.org/sf26eu/speaker/ZFQRPP/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/CGU8JY/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/CGU8JY/", "attachments": []}, {"guid": "89e01eb6-5de5-5b1d-96af-338f78c1b805", "code": "KLMHAK", "id": 265, "logo": null, "date": "2026-11-04T13:30:00+01:00", "start": "13:30", "end": "2026-11-04T14:30:00+01:00", "duration": "01:00", "room": "Room 2", "slug": "sf26eu-265-post-quantum-cryptography-the-end-of-security", "url": "https://conference.wireshark.org/sf26eu/talk/KLMHAK/", "title": "Post-Quantum Cryptography \u2013 The End of Security?", "subtitle": "", "track": "Security", "type": "Presentation", "language": "en", "abstract": "Quantum computers have the potential to break much of the public-key cryptography that protects today's Internet. Although large-scale quantum computers do not yet exist, organisations are already preparing for the day they become a reality.\n\nThis session provides a practical introduction to Post-Quantum Cryptography (PQC). We'll separate hype from reality, explain what quantum computers can and cannot do, discuss the \"Harvest Now, Decrypt Later\" threat, and introduce the new generation of standardised PQC algorithms.\n\nFinally, we'll explore where PQC is already being deployed\u2014from TLS and IPsec to X.509 certificates and DNSSEC\u2014and what these changes mean for network engineers, security professionals, and packet analysts. Along the way, we'll use Wireshark to examine how post-quantum cryptography appears on the wire and what to look for in real-world network captures.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "YP7RTT", "name": "Johannes Weber", "avatar": "https://conference.wireshark.org/media/avatars/PXP8DZ_GRq6JRm.jpg", "biography": "Johannes works as a network security consultant at SVA System Vertrieb Alexander GmbH in Germany, holding a master's degree in IT Security with a specialisation in IPv6 Security. He excels in implementing next-gen firewalls, DNS appliances, and IPv6 connectivity at customer sites. As a trainer, Johannes conducts classes on IPv6 and DNS, focusing on in-depth technical discussions and security features. His insights and tutorials on IPv6, VPNs, DNSSEC, NTP, Wireshark, and enterprise-grade firewalls (Palo Alto Networks, Fortinet) can be found on his blog at https://weberblog.net/.\n\nFor German listeners, he hosts the Security-as-a-Podcast, https://securityasapodcast.de/.", "public_name": "Johannes Weber", "guid": "036ba2a0-dbba-5a41-ba93-d05e9d552d76", "url": "https://conference.wireshark.org/sf26eu/speaker/YP7RTT/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/KLMHAK/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/KLMHAK/", "attachments": []}, {"guid": "b8480970-0483-556f-97ed-348044ad49b3", "code": "ZB9ZW9", "id": 254, "logo": null, "date": "2026-11-04T14:45:00+01:00", "start": "14:45", "end": "2026-11-04T15:45:00+01:00", "duration": "01:00", "room": "Room 2", "slug": "sf26eu-254-reconsideration-of-perimeter-security-in-times-of-genai", "url": "https://conference.wireshark.org/sf26eu/talk/ZB9ZW9/", "title": "Reconsideration of perimeter security in times of GenAI", "subtitle": "", "track": "Security", "type": "Presentation", "language": "en", "abstract": "Traditional network security, especially in the good old \"perimeter\" almost outlived its best practices in the last years. The ever-increasing shift to cloud deployments, cloud services, zero-trust and such led to the need to reshape, what we should think of as our perimeter and especially, what is needed in terms of visibility on the network connections at various spots inside corporate environments.\n\nThe recent huge hype around GenAI models like Mythos and others, fueled additional doom saying across the industry and enabled yet another sales wave of must-have $things which should be taken with great caution.\n\nIn this session, we will highlight the current threat modeling for perimeter security, focusing on state-of-the-art best practices and pragmatic, realistic and value-driven measures to evaluate what is really needed and how to best achieve this for staying on top of existing and emerging threats.", "description": "", "recording_license": "", "do_not_record": true, "persons": [{"code": "WKSMHW", "name": "Christian Landstr\u00f6m", "avatar": "https://conference.wireshark.org/media/avatars/KHPGU3_V4QithB.webp", "biography": "Christian Landstr\u00f6m is the Head of Siemens CERT. In his previous roles over the past 15 years, he worked as CSIRT Lead DACH for NVISO Security, as Head of Managed Security Services at GDATA Advanced Analytics and as Incident Response and security audit expert for Airbus Cybersecurity. He shares his passion about network analysis together with Jasper and Eddi with whom he started working in the field of network security and cyber security back in 2006 and since then has been an integral part of the Sharkfest Community for over 15 years now.", "public_name": "Christian Landstr\u00f6m", "guid": "449fa0bf-7bf8-5204-9f0e-64c866fe71bf", "url": "https://conference.wireshark.org/sf26eu/speaker/WKSMHW/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/ZB9ZW9/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/ZB9ZW9/", "attachments": []}, {"guid": "7b21337e-e098-5f43-8817-a7c1eb7099a9", "code": "CS3YAN", "id": 266, "logo": null, "date": "2026-11-04T16:00:00+01:00", "start": "16:00", "end": "2026-11-04T17:00:00+01:00", "duration": "01:00", "room": "Room 2", "slug": "sf26eu-266-detecting-network-based-covert-channels-with-wireshark", "url": "https://conference.wireshark.org/sf26eu/talk/CS3YAN/", "title": "Detecting Network based Covert Channels with Wireshark", "subtitle": "", "track": "Security", "type": "Presentation", "language": "en", "abstract": "Modern network security mechanisms primarily focus on detecting known attack signatures and anomalous traffic volumes. However, network-based covert channels present a sophisticated threat by exfiltrating data and establishing Command-and-Control (C2) communication disguised as legitimate traffic. By manipulating protocol fields within standard suites\u2014such as DNS, ICMP, or TCP headers\u2014adversaries can bypass perimeter defenses undetected. The presentation begins with a structured introduction to the fundamentals of covert channels, establishing a theoretical foundation for their categorization and mechanics. Following this introduction, I will demonstrate practical detection methodologies directly within Wireshark using real-world traffic captures.", "description": "", "recording_license": "", "do_not_record": true, "persons": [{"code": "JGV78Q", "name": "Daniel Spiekermann", "avatar": null, "biography": "Daniel Spiekermann has more than 20 years of experience in communications technology and worked for many years as a forensic scientist for various law enforcement agencies, focusing on computer and network forensics. After completing his doctorate at the FernUniversit\u00e4t in Hagen in 2019, he began working as a professor of digital forensics at the Lower Saxony Police Academy in 2020. Since 2023, he has been teaching as a professor of distributed systems at the Dortmund University of Applied Sciences and Arts, conducting research on virtual networks and digital forensics.", "public_name": "Daniel Spiekermann", "guid": "2eba959c-abb4-5b14-9132-0595c32fbef6", "url": "https://conference.wireshark.org/sf26eu/speaker/JGV78Q/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/CS3YAN/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/CS3YAN/", "attachments": []}, {"guid": "c469fd38-d803-56dd-a29d-3e37f5c15d85", "code": "ZCXLSF", "id": 278, "logo": null, "date": "2026-11-04T17:15:00+01:00", "start": "17:15", "end": "2026-11-04T18:15:00+01:00", "duration": "01:00", "room": "Room 2", "slug": "sf26eu-278-solving-cybersecurity-with-ja4-network-fingerprinting", "url": "https://conference.wireshark.org/sf26eu/talk/ZCXLSF/", "title": "Solving Cybersecurity with JA4+ Network Fingerprinting", "subtitle": "", "track": "Security", "type": "Presentation", "language": "en", "abstract": "In this presentation I will explain how JA4+ network fingerprinting works, the latest updates to the fingerprint family, and show you how to easily identify devices, malware, malicious servers, inbound threats and more by passively analyzing network traffic with JA4+ and without needing to break encryption. Real-world nation-state examples and war stories included.\n\nJA4+ is free and available across a wide range of open source and vendor tools you already use including Wireshark, Zeek, Arkime, Suricata, nginx, F5, Censys, Vectra, etc.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "XEWGCB", "name": "John Althouse", "avatar": null, "biography": "John Althouse was previously at Salesforce for 10 years as the Director of Threat Detection. While there, John and his team created notable network fingerprinting methods such as JA3/S, JARM, and HASSH, used throughout the industry. He is now working full-time on JA4+ network fingerprinting to solve as many cybersecurity challenges as possible.", "public_name": "John Althouse", "guid": "306c555c-02e0-5a45-a3cf-848ce6f9081d", "url": "https://conference.wireshark.org/sf26eu/speaker/XEWGCB/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/ZCXLSF/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/ZCXLSF/", "attachments": []}]}}, {"index": 4, "date": "2026-11-05", "day_start": "2026-11-05T04:00:00+01:00", "day_end": "2026-11-06T03:59:00+01:00", "rooms": {"Room 1": [{"guid": "199b529f-bcf1-5bd8-8555-4cef8b2215d7", "code": "UQC33X", "id": 271, "logo": null, "date": "2026-11-05T09:00:00+01:00", "start": "09:00", "end": "2026-11-05T10:00:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-271-keynote-realizing-the-closed-loop-automation", "url": "https://conference.wireshark.org/sf26eu/talk/UQC33X/", "title": "Keynote: Realizing the Closed Loop Automation", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "Covering the latest industry and standard trends towards closed loop in automation.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "WKTHJJ", "name": "Benoit Claise", "avatar": null, "biography": "Ex-Cisco Fellow & Ex-Huawei Intelligent Operations Management CTO, Benoit created his own consulting \u201cEverything OPS\u201d company focused on his passion: Autonomous Driving Networks vision. \nBenoit has been focusing on config management, network automation, data-model driven management. The latest focus is on data collection, service assurance, with the model-driven telemetry for closed loop automation, on digital map, intent, and knowledge graph and a renewed interest for IPIFX\u2026 as building blocks to reduce the cost of managing networks. \nBenoit is currently the co-chair for the IETF OPSAWG and NMOP WGs, and served a 6 years term as IETF Operational and Management Area Director, exclusively focused on the YANG models standardization, along with automatic configuration (via NETCONF, RESTCONF, YANG-Push).\nBooks: Network Programmability with YANG: \u201c The Structure of Network Automation with YANG, NETCONF, RESTCONF, and gNMI\u201d and \u201cNetwork management: Accounting and Performance Strategies.\u201d", "public_name": "Benoit Claise", "guid": "fb70c4b3-292a-598b-a030-43e0d5fcd1f5", "url": "https://conference.wireshark.org/sf26eu/speaker/WKTHJJ/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/UQC33X/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/UQC33X/", "attachments": []}, {"guid": "d97e8bfa-3e53-5c33-8695-342040ad3dd0", "code": "QFMVBK", "id": 230, "logo": null, "date": "2026-11-05T10:15:00+01:00", "start": "10:15", "end": "2026-11-05T11:15:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-230-does-it-matter", "url": "https://conference.wireshark.org/sf26eu/talk/QFMVBK/", "title": "Does it Matter?", "subtitle": "", "track": "Beginner", "type": "Presentation", "language": "en", "abstract": "What is the most effective approach to rapidly gaining a deep understanding of a new network protocol? In this 1-hour session, the speaker will share practical experiences and lessons learned from studying the Matter protocol. In addition to an introduction to the protocol itself, the talk will focus on a structured and broadly applicable methodology for analyzing and understanding complex network protocols.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "7WXPZN", "name": "Tom Cordemans", "avatar": "https://conference.wireshark.org/media/avatars/YY3RVA_D1bsfSr.webp", "biography": "Tom Cordemans is a senior lecturer at the Odisee University of Applied Sciences and a researcher at the DistriNet Research Unit of KU Leuven in Ghent, Belgium with a strong focus on IT, IoT and OT networks. He is a daily user of Wireshark and sharing knowledge and expertise is his trigger to give workshops and presentations.", "public_name": "Tom Cordemans", "guid": "fe5c00c7-2a6f-58d2-b4a9-484d75ff3f41", "url": "https://conference.wireshark.org/sf26eu/speaker/7WXPZN/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/QFMVBK/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/QFMVBK/", "attachments": []}, {"guid": "82d4408c-56f4-5dc3-916f-55cccc10b42b", "code": "USXFHG", "id": 281, "logo": null, "date": "2026-11-05T11:30:00+01:00", "start": "11:30", "end": "2026-11-05T12:30:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-281-beyond-strace-syscall-analysis-the-wireshark-way", "url": "https://conference.wireshark.org/sf26eu/talk/USXFHG/", "title": "Beyond Strace: Syscall Analysis the Wireshark Way", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "Every Linux engineer knows the moment: a process is misbehaving, so you reach for strace, get a wall of text, and start grepping. It works - until the problem spans multiple processes, the output is too much to read, or you need to correlate what a process did to the system with what it did on the network. strace and bpftrace are excellent at capturing syscalls. \n\nStratoshark takes a different approach: it captures system calls and logs system-wide through the Falco libraries, then hands them to the same analysis engine that has served packet analysts for 25 years \u2014 display filters, coloring rules, follow-stream views, time correlation, and shareable capture files.\n\nIn this talk I'll show how a Wireshark user's instincts transfer directly to syscall troubleshooting, where Stratoshark beats reaching for strace, and where the older tools are still the right call. Real debugging scenarios, honest limitations, and a clear picture of when this newer approach earns its place in your toolbox.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "38N3ZL", "name": "Roland Knall", "avatar": null, "biography": null, "public_name": "Roland Knall", "guid": "4901d52b-9ac3-54a1-8f8f-00795e1bd75d", "url": "https://conference.wireshark.org/sf26eu/speaker/38N3ZL/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/USXFHG/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/USXFHG/", "attachments": []}, {"guid": "4396c2f2-72f0-5435-8cf0-259e3cd022e3", "code": "7N8Q9Q", "id": 217, "logo": null, "date": "2026-11-05T13:30:00+01:00", "start": "13:30", "end": "2026-11-05T15:00:00+01:00", "duration": "01:30", "room": "Room 1", "slug": "sf26eu-217-the-packet-doctors-are-in-packet-trace-examinations-with-the-experts", "url": "https://conference.wireshark.org/sf26eu/talk/7N8Q9Q/", "title": "The Packet Doctors are in! Packet trace examinations with the experts", "subtitle": "", "track": null, "type": "Packetdoctors Session", "language": "en", "abstract": "The experts on this panel have been asked to look at a trace file and help find a reason for certain behaviors by attendees at many SharkFests. Based on this, they\u2019ve decided to create a public forum for examining individual trace files with a broader audience for a collective learning experience. Trace files will be gathered from attendees prior to SharkFest and only given to the panel members during the session so that the \u201cnot-\nknowing what to expect and whether it can be solved\u201d experience of working through an unknown trace file can be preserved.\nCome to this session and learn to ask the right questions and look at packets in different ways.\nPLEASE SEND PERPLEXING TRACE FILES FOR ANALYSIS BY THE PANEL TO jasper@packet-foo.com PRIOR TO SHARKFEST!", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/7N8Q9Q/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/7N8Q9Q/", "attachments": []}, {"guid": "211dd036-a4c1-53c2-ae5f-1b49a7c22757", "code": "T3HQTP", "id": 269, "logo": null, "date": "2026-11-05T15:15:00+01:00", "start": "15:15", "end": "2026-11-05T16:15:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-269-more-than-just-ping-a-closer-look-at-icmpv4-6", "url": "https://conference.wireshark.org/sf26eu/talk/T3HQTP/", "title": "More than just Ping. A closer look at ICMPv4/6.", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "When people hear the term \u2018ICMP\u2019, most think of \u2018Ping\u2019 first. However, there are many more ICMP types and codes.\nIn this session, we\u2019ll look at the most important ones, when they occur, how they can help troubleshoot issues, and which ones should be blocked and which ones shouldn\u2019t.\n\nWe\u2019ll also look at ICMPv6, which plays an even more important role in fundamental network functions.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "XX7TR9", "name": "Uli Heilmeier", "avatar": "https://conference.wireshark.org/media/avatars/telefonbuch_uhei_neu_YZK2f7y.png", "biography": "Uli has been working somewhere between IT/OT infrastructure and IT/OT security for more than two decades. His current position is \u2018IT Security Architect\u2019 at Krones AG. He has been a member of the Core Developer Team since 2021.", "public_name": "Uli Heilmeier", "guid": "968c2bc4-8638-55b5-99be-7a77d3b4abb8", "url": "https://conference.wireshark.org/sf26eu/speaker/XX7TR9/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/T3HQTP/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/T3HQTP/", "attachments": []}, {"guid": "13b4bc1a-15c1-512e-a7f5-8cbf25bee5c7", "code": "GDRHLA", "id": 248, "logo": "https://conference.wireshark.org/media/sf26eu/submissions/GDRHLA/image_WdkCqT0.webp", "date": "2026-11-05T16:30:00+01:00", "start": "16:30", "end": "2026-11-05T17:30:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-248-six-ways-to-skin-a-packet-capturing-packets-in-dpdk", "url": "https://conference.wireshark.org/sf26eu/talk/GDRHLA/", "title": "Six ways to skin a packet - capturing packets in DPDK", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "The Dataplane Development Kit (DPDK) is used by many proprietary and open source network infrastructure products. One limitation of the DPDK is that since it bypasses the kernel, most standard packet capture tools (such as tcpdump and wireshark) won't work as expected. I will cover six alternative ways to capture packets with DPDK and what the tradeoffs are in terms of integration, performance, and features.", "description": "The six different ways (in no particular order) are:\n\nDPDK's builtin pdump framework which is used by the tools dpdk-pdump and dpdk-dumpcap.\nlibpcap-dpdk - integration of DPDK backend into libpcap\nrpcap - remote capture protocol support in DPDK; example targeted for 26.11 release\ngrout libpcap - integration of libpcap in graph-route project\nnetcap - eBPF trace hook support for packet capture\nextcap - DPDK integration with extcap; library targeted for 26.11 release\n\nWill cover all of them for comparison and do performance tests on those that are similar.", "recording_license": "", "do_not_record": false, "persons": [{"code": "9CMGQH", "name": "Stephen Hemminger", "avatar": null, "biography": "Stephen Hemminger is a member of the DPDK technical board who wrote the pcapng library and dpdk-dumpcap tool. He worked for many years at Microsoft, Brocade, and Linux Foundation contributing to networking related open source projects including the Linux kernel. Since retirement he spends more time on open source! He co-maintains iproute2 and several DPDK components.", "public_name": "Stephen Hemminger", "guid": "3ec9aef2-a632-5b07-81a3-fd711f329d05", "url": "https://conference.wireshark.org/sf26eu/speaker/9CMGQH/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/GDRHLA/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/GDRHLA/", "attachments": []}, {"guid": "5c926951-c20e-5860-bd18-990415203ae6", "code": "SJCUL7", "id": 270, "logo": null, "date": "2026-11-05T17:45:00+01:00", "start": "17:45", "end": "2026-11-05T18:30:00+01:00", "duration": "00:45", "room": "Room 1", "slug": "sf26eu-270-how-to-find-problems-quickly-in-a-trace-file-and-win-the-packet-challenge", "url": "https://conference.wireshark.org/sf26eu/talk/SJCUL7/", "title": "How to find problems quickly in a trace file (and win the packet challenge)", "subtitle": "", "track": "Beginner", "type": "Presentation", "language": "en", "abstract": "This beginner-friendly presentation introduces you to basic Wireshark techniques to find problems quickly. This includes lesser known Wireshark features, that are super-helpful in daily network analysis.\n\nThe session also covers the team work approach to network analysis: How to coordinate the team members work and keep track of results.", "description": "Returning Sharkfest attendees know, that the packet challenge is a team effort. This year, you need to regain control of a [redacted]. To complete the mission, the team has to apply elementary network forensics skills to extract data from a trace file.\nThe challenge is build so that (hopefully) every team can solve it. This session gives you the tools to complete the challenge first and take home the price.", "recording_license": "", "do_not_record": true, "persons": [{"code": "GLTC9C", "name": "Eddi Blenkers", "avatar": null, "biography": "For over 20 years, Eddi has been looking at network protocols to find (or rule out) network problems, vulnerabilities, ongoing hacking attacks or just for fun.\n\nWorking for the Swiss train company BLS as IT security analyst, he is reviewing the configuration of a multitude of systems to improve the overall security of the domain. Wireshark is one of the tools to verify the outcome of a configuration change.\n\nShameless promotion: Visit https://www.bls.ch/en/freizeit-und-ferien/ausflug to find some of the best destinations in Switzerland.", "public_name": "Eddi Blenkers", "guid": "e83c010f-ca2a-5091-9e2a-357873c970cf", "url": "https://conference.wireshark.org/sf26eu/speaker/GLTC9C/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/SJCUL7/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/SJCUL7/", "attachments": []}, {"guid": "beee3b26-4678-5f29-a610-80d6a210d79c", "code": "CNTVYR", "id": 264, "logo": null, "date": "2026-11-05T18:30:00+01:00", "start": "18:30", "end": "2026-11-05T21:00:00+01:00", "duration": "02:30", "room": "Room 1", "slug": "sf26eu-264-sponsor-technology-showcase-reception-espcape-group-packet-challenge-and-dinner", "url": "https://conference.wireshark.org/sf26eu/talk/CNTVYR/", "title": "Sponsor Technology Showcase Reception, esPCAPe Group Packet Challenge and Dinner", "subtitle": "", "track": null, "type": "Dinner", "language": "en", "abstract": "Sponsor showcase, group packet challenge and dinner", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/CNTVYR/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/CNTVYR/", "attachments": []}], "Room 2": [{"guid": "78b7fe25-edb7-562f-9b50-eb8f982ed452", "code": "C9XATS", "id": 272, "logo": null, "date": "2026-11-05T10:15:00+01:00", "start": "10:15", "end": "2026-11-05T11:15:00+01:00", "duration": "01:00", "room": "Room 2", "slug": "sf26eu-272-web-vulnerabilities-in-wireshark", "url": "https://conference.wireshark.org/sf26eu/talk/C9XATS/", "title": "Web Vulnerabilities in Wireshark", "subtitle": "", "track": "Security", "type": "Presentation", "language": "en", "abstract": "Modern web infrastructure doesn't route on IP addresses. Load balancers, proxies, and CDNs all make routing decisions based on application-layer content like Host headers, forwarding headers and request paths. This is how the web works at scale. But it creates a gap: the transport layer tells you exactly where a connection went, and above it, the web layer tells servers things the transport layer has no way to verify. I have been spending a lot of time in this territory while studying for my Burp Suite Certified Practitioner exam. The disagreement between what the IP layer says and what the web layer does is right there in a packet capture. This talk covers the main classes where the layers stop agreeing, and what each one looks like in Wireshark.", "description": "This talk walks through the main classes where this gap shows up, using real packet captures. For each one, I'll show what the disagreement looks like in Wireshark; where the transport layer and the web layer stop telling the same story, and what the server does as a result. No prior web security knowledge needed.", "recording_license": "", "do_not_record": false, "persons": [{"code": "DZGUZF", "name": "Katherine Leese", "avatar": "https://conference.wireshark.org/media/avatars/jlwS2nT-_JlbtYxz.jpg", "biography": "Katherine is a tech professional with 4 years of experience, having retrained in her 40s to become a Computer Expert, specialising in System Integration. Originally from New Zealand, she is currently based in Germany. During her training, she undertook a practicum at SevenShift, a boutique IoT cybersecurity company in Cologne that recognised her talent and dedication, ultimately hiring her. She is now employed there, where she is honing her skills and contributing to the company's security initiatives. Outside of her professional life, Katherine is a dedicated single mother to a teenager. She is a member of the Haecksen, the FINTA branch of the CCC, and a Chapter Leader of OWASP Cologne.", "public_name": "Katherine Leese", "guid": "b04186f2-ebbf-5d2c-bdef-e76b840f606a", "url": "https://conference.wireshark.org/sf26eu/speaker/DZGUZF/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/C9XATS/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/C9XATS/", "attachments": []}, {"guid": "ee9d7942-311d-5436-9d1d-39c643e1b06a", "code": "BEJNUY", "id": 280, "logo": null, "date": "2026-11-05T11:30:00+01:00", "start": "11:30", "end": "2026-11-05T12:30:00+01:00", "duration": "01:00", "room": "Room 2", "slug": "sf26eu-280-attacks-in-the-network-a-look-at-real-world-malicious-traffic-examples", "url": "https://conference.wireshark.org/sf26eu/talk/BEJNUY/", "title": "Attacks in the Network - A look at real world malicious traffic examples", "subtitle": "", "track": "Security", "type": "Presentation", "language": "en", "abstract": "It's not easy to spot attacks in network packets, mostly because there's so many of them (packets, that is), resulting in the Signal-to-Noise ratio is extremely high. But there are also additional challenges, like encryption or attackers simply using protocols that administrators use themselves. We'll take a look at a number of real world scenarios and learn about various attack patterns and how to find/recognize them.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "ZFQRPP", "name": "Jasper Bongertz", "avatar": null, "biography": null, "public_name": "Jasper Bongertz", "guid": "a9000fe3-d4d0-5e13-a7b1-425214071202", "url": "https://conference.wireshark.org/sf26eu/speaker/ZFQRPP/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/BEJNUY/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/BEJNUY/", "attachments": []}, {"guid": "771f825a-201c-5981-9c05-536cb004273e", "code": "QSQ8WN", "id": 277, "logo": null, "date": "2026-11-05T15:15:00+01:00", "start": "15:15", "end": "2026-11-05T16:15:00+01:00", "duration": "01:00", "room": "Room 2", "slug": "sf26eu-277-3gpp-all-things-lte", "url": "https://conference.wireshark.org/sf26eu/talk/QSQ8WN/", "title": "3GPP All things LTE", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "Mobile networks depend on complex, multi-layered protocols for mobility management, authentication, and voice-over-LTE (VoLTE), wireless and telecom engineers heavily utilize Wireshark to troubleshoot cellular call flows. This session will cover what protocols those engineers look at on a daily basis, and how they set up wireshark, and cli to troubleshooting problems.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "XCPJMV", "name": "Mark Stout", "avatar": null, "biography": null, "public_name": "Mark Stout", "guid": "0a0bb26a-146a-516e-b360-ae0069a5250c", "url": "https://conference.wireshark.org/sf26eu/speaker/XCPJMV/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/QSQ8WN/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/QSQ8WN/", "attachments": []}, {"guid": "1632043a-48f7-51ab-86e0-e5aa4e402cd3", "code": "JEHBPH", "id": 279, "logo": null, "date": "2026-11-05T16:30:00+01:00", "start": "16:30", "end": "2026-11-05T17:30:00+01:00", "duration": "01:00", "room": "Room 2", "slug": "sf26eu-279-ai-found-holes-in-our-cheese", "url": "https://conference.wireshark.org/sf26eu/talk/JEHBPH/", "title": "AI Found Holes In Our Cheese", "subtitle": "", "track": "Security", "type": "Presentation", "language": "en", "abstract": "This past spring, the software world was rocked by AI vulnerability storm, as the state of the art in AI vulnerability scanning advanced rapidly, and flaws were found in the software that we use every day. Wireshark wasn't spared from this, and in this talk Gerald will show how Wireshark was impacted, and the processes and tools that the development team uses to protect Wireshark from security issues.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "W3ATCJ", "name": "Gerald Combs", "avatar": null, "biography": null, "public_name": "Gerald Combs", "guid": "48b28b2b-1b95-530b-917b-77a2ff959d3c", "url": "https://conference.wireshark.org/sf26eu/speaker/W3ATCJ/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/JEHBPH/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/JEHBPH/", "attachments": []}]}}, {"index": 5, "date": "2026-11-06", "day_start": "2026-11-06T04:00:00+01:00", "day_end": "2026-11-07T03:59:00+01:00", "rooms": {"Room 1": [{"guid": "27b208e7-90a8-51b2-8e4b-b66156fc6862", "code": "8ZV9GX", "id": 215, "logo": null, "date": "2026-11-06T09:00:00+01:00", "start": "09:00", "end": "2026-11-06T10:00:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-215-sharkbytes", "url": "https://conference.wireshark.org/sf26eu/talk/8ZV9GX/", "title": "SharkBytes", "subtitle": "", "track": "Organization", "type": "Organization", "language": "en", "abstract": "SharkBytes consist of \u201clittle crunchy bits of wisdom.\u201d Like popular TED talks, SharkBytes aim to inform, inspire, surprise, and delight by delivering a speech on a personal topic in under 5 minutes.\n\nInformation and a review of past SharkByte presentations can be found https://sharkfest.wireshark.org/sharkbytes\n\nEmail us your SharkByte session idea: sharkfest@wireshark.org", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/8ZV9GX/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/8ZV9GX/", "attachments": []}, {"guid": "7760a2fa-bf41-55ee-a950-bcc2424225d4", "code": "RBVXHR", "id": 244, "logo": null, "date": "2026-11-06T10:15:00+01:00", "start": "10:15", "end": "2026-11-06T11:15:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-244-packets-don-t-lie-until-they-do", "url": "https://conference.wireshark.org/sf26eu/talk/RBVXHR/", "title": "Packets don't lie... until they do!", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "We have all heard (and used) the phrase \"Packets don't lie\". We live by this mantra. And of course, packets do give evidence to the cause of sometimes complex issues. But as in evidence in criminal cases, this evidence is also subject to how it was taken and from which point of view.\n\nThis presentation will lay out many ways in which packets might not tell the truth, the whole truth and nothing but the truth.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "PXDFUJ", "name": "Sake Blok", "avatar": "https://conference.wireshark.org/media/avatars/profile-2025-400x400_hgdKmpu.png", "biography": "Sake has been analyzing packets for over 25 years. During his work, Sake started developing functionality for Wireshark while working with the analyzer in his day-to-day job. He also enhanced multiple protocol dissectors. In 2007, Sake joined the Wireshark Core Development team. In 2009, After working for a reseller of networking equipment for 8 years, he started the company SYN-bit to provide network analysis and training services to enterprises across Europe.", "public_name": "Sake Blok", "guid": "47d71e8b-c095-541f-8e0f-246c3adf6a12", "url": "https://conference.wireshark.org/sf26eu/speaker/PXDFUJ/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/RBVXHR/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/RBVXHR/", "attachments": []}, {"guid": "6369757a-eccf-5586-9870-4859a300fa33", "code": "DBWVZS", "id": 263, "logo": null, "date": "2026-11-06T11:30:00+01:00", "start": "11:30", "end": "2026-11-06T12:30:00+01:00", "duration": "01:00", "room": "Room 1", "slug": "sf26eu-263-sharkfest-group-packet-challenge-walkthrough", "url": "https://conference.wireshark.org/sf26eu/talk/DBWVZS/", "title": "SharkFest group packet challenge Walkthrough", "subtitle": "", "track": "Beginner", "type": "Presentation", "language": "en", "abstract": "It is a time honored tradition at SharkFest, that attendees sit together in teams and solve a packet challenge as a team.\n\nIn this presentation we will walk you through this year's group packet challenge.", "description": "In this years challenge, attendees recover data from a trace file to regain control over a **redacted** that is out of control. \n\nSpoiler: Data recovery is an exercise in network forensics. \n\nWe will demonstrate, how Wireshark can be used to extract the relevant details. Bring your own laptop to get the most out of this session.", "recording_license": "", "do_not_record": true, "persons": [{"code": "GLTC9C", "name": "Eddi Blenkers", "avatar": null, "biography": "For over 20 years, Eddi has been looking at network protocols to find (or rule out) network problems, vulnerabilities, ongoing hacking attacks or just for fun.\n\nWorking for the Swiss train company BLS as IT security analyst, he is reviewing the configuration of a multitude of systems to improve the overall security of the domain. Wireshark is one of the tools to verify the outcome of a configuration change.\n\nShameless promotion: Visit https://www.bls.ch/en/freizeit-und-ferien/ausflug to find some of the best destinations in Switzerland.", "public_name": "Eddi Blenkers", "guid": "e83c010f-ca2a-5091-9e2a-357873c970cf", "url": "https://conference.wireshark.org/sf26eu/speaker/GLTC9C/"}, {"code": "PXDFUJ", "name": "Sake Blok", "avatar": "https://conference.wireshark.org/media/avatars/profile-2025-400x400_hgdKmpu.png", "biography": "Sake has been analyzing packets for over 25 years. During his work, Sake started developing functionality for Wireshark while working with the analyzer in his day-to-day job. He also enhanced multiple protocol dissectors. In 2007, Sake joined the Wireshark Core Development team. In 2009, After working for a reseller of networking equipment for 8 years, he started the company SYN-bit to provide network analysis and training services to enterprises across Europe.", "public_name": "Sake Blok", "guid": "47d71e8b-c095-541f-8e0f-246c3adf6a12", "url": "https://conference.wireshark.org/sf26eu/speaker/PXDFUJ/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/DBWVZS/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/DBWVZS/", "attachments": []}], "Room 2": [{"guid": "fdb001d0-674c-5fbc-9e3d-39244e48a19e", "code": "GW9JQG", "id": 233, "logo": null, "date": "2026-11-06T10:15:00+01:00", "start": "10:15", "end": "2026-11-06T11:15:00+01:00", "duration": "01:00", "room": "Room 2", "slug": "sf26eu-233-wireshark-with-webbrowser", "url": "https://conference.wireshark.org/sf26eu/talk/GW9JQG/", "title": "Wireshark With WebBrowser", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "Wireshark is now the world's most powerful packet analysis tool, and we can get more features and visualisation with your daily web browser!!", "description": "You may take the longest time with the Web Browser in your computer, how about using your web browser with Wireshark? The modern web browser have many useful functions to extend Wireshark without any additional cost. \nIn this session you can learn Wireshark enhancement with Web Browser. For example, we can use browser extensions for Wireshark, we can enrich our Wireshark visualization to make use of the web browser, and so on.", "recording_license": "", "do_not_record": false, "persons": [{"code": "LFFBGF", "name": "Megumi Takeshita", "avatar": "https://conference.wireshark.org/media/avatars/ea73b656018238499cd621f442bec89d_hPlCb4o.jpg", "biography": "Megumi Takeshita, packet otaku, runs a packet company, ikeriri network service in Japan. Ikeriri offers services such as packet analysis for troubleshooting, debugging, security inspection. Ikeriri is also a reseller of wired/wireless capture and analysis products. Megumi has authored 10+ books about Wireshark and packet analysis. She also instructs Wireshark for Japanese companies, including the Japan Self-Defence Forces and Chuo University, as a lecturer. She is one of contributors to the Wireshark projects including Japanese localization.", "public_name": "Megumi Takeshita", "guid": "cd305923-7b56-50e4-a24e-eb5ca1c213fb", "url": "https://conference.wireshark.org/sf26eu/speaker/LFFBGF/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26eu/talk/GW9JQG/feedback/", "origin_url": "https://conference.wireshark.org/sf26eu/talk/GW9JQG/", "attachments": []}]}}]}}}