2.0 -//Pentabarf//Schedule//EN PUBLISH 7JUZMZ@@conference.wireshark.org -7JUZMZ Pre-Conference Class I: Practical Wireshark Skills for IT professionals en en 20261102T090000 20261102T170000 080000

Pre-Conference Class I: Practical Wireshark Skills for IT professionals

Level up your Wireshark skills and get ready for Sharkfest! This hands-on course will provide core Wireshark skills for IT pros of all experience levels. Participants will gain a solid understanding of how to use Wireshark to capture, analyze, and troubleshoot network traffic. The course is designed with beginners in mind, but even seasoned packet people will pick up new tips and tricks. PUBLIC CONFIRMED Pre Conference Class https://conference.wireshark.org/sf26eu/talk/7JUZMZ/ Room 1 Ross Bagurdes PUBLISH 7TVPHQ@@conference.wireshark.org -7TVPHQ Pre-Conference Class II: WebRTC Network Analysis Masterclass en en 20261102T090000 20261102T170000 080000

Pre-Conference Class II: WebRTC Network Analysis Masterclass

## Agenda Which products use WebRTC and how are they different **Call setup in a nutshell** (explained with a capture - we use one very typical capture throughout the course) - What happens before WebRTC kicks in (Signaling, SDP) - Connectivity detection ICE/STUN/TURN - What can I optimize on client side (restrict candidates) **Analyzing the capture** - What AI can tell us about the capture - Go through the setup packet by packet and check the media flows **Media Performance** - UDP vs TCP - Packet loss & delay in a worldwide network **Doing a live capture** - Decrypt signaling - Check a few selected captures **The nasty stuff (and how to deal with it)** - Packet filters - Proxies & Zscaler - VPN & SDWAN - Reconnect times - TURN servers **What's the difference in how the various products use WebRTC** Teams Zoom Webex GotoMeeting Google Meet PUBLIC CONFIRMED Pre Conference Class https://conference.wireshark.org/sf26eu/talk/7TVPHQ/ Room 2 Robert Hess Alexander Muellrr PUBLISH VKPWM3@@conference.wireshark.org -VKPWM3 Pre-conference class IV: SMB Masterclass en en 20261102T090000 20261102T170000 080000

Pre-conference class IV: SMB Masterclass

This class will enable students to investigate functional issues and performance problems. Topics covered are * SMB Handshake, selection of a dialect version and user authentication * General process of mounting a share and accessing files * Tracking SMB sessions over multiple interfaces or IP-addresses * Investigating error codes * Decryption of SMB traffic (not for the faint-hearted) * The role of Kerberos in authentication, encryption and Wireshark-based decryption * Understanding the service response time feature for SMB * Baselining application behavior for SMB file access * identification of performance bottlenecks in the network, application logic, client or server * SMB functions beyond file sharing (IPC, Named Pipes) * Identificaiton of malicious named pipes, that could be used for malware control Here is, what previous students say about the class: - Great class, good walk throu of SMB troubleshooting. I enjoyed it very much. Made a lot of things i struggled with earlier a lot clearer to me. - It was fantastic! I now definitely have a better overview over what SMB is doing. - Great and awesome deep dive!!! PUBLIC CONFIRMED Pre Conference Class https://conference.wireshark.org/sf26eu/talk/VKPWM3/ Room 3 Eddi Blenkers PUBLISH 7JUZMZ@@conference.wireshark.org -7JUZMZ Pre-Conference Class I: Practical Wireshark Skills for IT professionals en en 20261103T090000 20261103T170000 080000

Pre-Conference Class I: Practical Wireshark Skills for IT professionals

Level up your Wireshark skills and get ready for Sharkfest! This hands-on course will provide core Wireshark skills for IT pros of all experience levels. Participants will gain a solid understanding of how to use Wireshark to capture, analyze, and troubleshoot network traffic. The course is designed with beginners in mind, but even seasoned packet people will pick up new tips and tricks. PUBLIC CONFIRMED Pre Conference Class https://conference.wireshark.org/sf26eu/talk/7JUZMZ/ Room 1 Ross Bagurdes PUBLISH XBMHVL@@conference.wireshark.org -XBMHVL SharkFest'26 EUROPE Welcome Dinner & Sponsor Showcase en en 20261103T173000 20261103T203000 030000

SharkFest'26 EUROPE Welcome Dinner & Sponsor Showcase

PUBLIC CONFIRMED Dinner https://conference.wireshark.org/sf26eu/talk/XBMHVL/ Room 1 PUBLISH 3PDG9V@@conference.wireshark.org -3PDG9V Pre-Conference Class III: The Proof is in the Packets: Network Threat Detection Using Wireshark en en 20261103T090000 20261103T170000 080000

Pre-Conference Class III: The Proof is in the Packets: Network Threat Detection Using Wireshark

PUBLIC CONFIRMED Pre Conference Class https://conference.wireshark.org/sf26eu/talk/3PDG9V/ Room 2 Marcelle Lee PUBLISH VKPWM3@@conference.wireshark.org -VKPWM3 Pre-conference class IV: SMB Masterclass en en 20261103T090000 20261103T170000 080000

Pre-conference class IV: SMB Masterclass

This class will enable students to investigate functional issues and performance problems. Topics covered are * SMB Handshake, selection of a dialect version and user authentication * General process of mounting a share and accessing files * Tracking SMB sessions over multiple interfaces or IP-addresses * Investigating error codes * Decryption of SMB traffic (not for the faint-hearted) * The role of Kerberos in authentication, encryption and Wireshark-based decryption * Understanding the service response time feature for SMB * Baselining application behavior for SMB file access * identification of performance bottlenecks in the network, application logic, client or server * SMB functions beyond file sharing (IPC, Named Pipes) * Identificaiton of malicious named pipes, that could be used for malware control Here is, what previous students say about the class: - Great class, good walk throu of SMB troubleshooting. I enjoyed it very much. Made a lot of things i struggled with earlier a lot clearer to me. - It was fantastic! I now definitely have a better overview over what SMB is doing. - Great and awesome deep dive!!! PUBLIC CONFIRMED Pre Conference Class https://conference.wireshark.org/sf26eu/talk/VKPWM3/ Room 3 Eddi Blenkers PUBLISH FH9DSQ@@conference.wireshark.org -FH9DSQ Keynote: Things I Love About Wireshark (and maybe a couple of things I don't) en en 20261104T090000 20261104T100000 010000

Keynote: Things I Love About Wireshark (and maybe a couple of things I don't)

PUBLIC CONFIRMED Organization https://conference.wireshark.org/sf26eu/talk/FH9DSQ/ Room 1 PUBLISH AHJB7N@@conference.wireshark.org -AHJB7N Packet stories #2 en en 20261104T101500 20261104T111500 010000

Packet stories #2

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/AHJB7N/ Room 1 Sake Blok PUBLISH 7ELU8V@@conference.wireshark.org -7ELU8V Packet capture basics; how do you get 'em en en 20261104T113000 20261104T123000 010000

Packet capture basics; how do you get 'em

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/7ELU8V/ Room 1 Jaap Keuter PUBLISH R9PZDM@@conference.wireshark.org -R9PZDM Transformers in the Wire: Advanced DPI Fingerprinting for AI/Stealth VPN Detection en en 20261104T133000 20261104T143000 010000

Transformers in the Wire: Advanced DPI Fingerprinting for AI/Stealth VPN Detection

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/R9PZDM/ Room 1 Luca Deri Daniele Sartiano PUBLISH 7TY7ZF@@conference.wireshark.org -7TY7ZF Build a datacenter on your laptop - an introduction and realtime examples of simulated networks en en 20261104T144500 20261104T154500 010000

Build a datacenter on your laptop - an introduction and realtime examples of simulated networks

A network lab no longer needs a rack or heavy VM appliances. With containerlab, a topology is a YAML file: nodes, links, addresses and startup commands, versioned in Git and deployed in seconds. Every node is a Linux container wired with veth pairs, so the traffic is real kernel networking – nothing simulated, everything open to packet analysis. Build it: starting from a clean laptop with VS Code and Docker, we deploy a client, a DNS server and a TLS web server, look at what containerlab creates underneath, and hit the typical day-one traps: subnet clashes, devcontainer path issues, missing return routes. See it: we compare four ways to capture inside containers, ending with Edgeshark, which lists every container interface in the browser and opens a live capture in your local Wireshark with one click. Live: DNS lookup, TCP handshake, a TLS Client Hello leaking the server name, and the same session decrypted with SSLKEYLOGFILE. Evolve it: the lab moves from static addresses to DHCP. We follow DISCOVER, OFFER, REQUEST and ACK and inspect the options up to Option 121 – and see that DHCP options are offers the client may ignore. Train with it: each training scenario is a topology file with a deliberate fault – a missing route, an overridden resolver, an ignored DHCP option. Trainees get a symptom ("the website doesn't load") and work down to the cause with Wireshark. Every trainee gets an identical lab, resets take seconds, and the fix is a one-line change. Takeaways: a running multi-node network in minutes, a capture workflow for containers that feels local, a method for building troubleshooting trainings from version-controlled labs, and an honest look at where container networks differ from real hardware. For network engineers, analysts and trainers who know Wireshark. No containerlab experience needed. PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/7TY7ZF/ Room 1 Roland Knall PUBLISH SCBU9V@@conference.wireshark.org -SCBU9V MACsec - Protocol overview and Analysis en en 20261104T160000 20261104T170000 010000

MACsec - Protocol overview and Analysis

MACsec was defined in 2006, but its prevalence has only been rising in recent years. It can provide Hop-by-Hop Encryption in Line-Rate between Switches or between Hosts and Switches. So analysts are looking for ways to analyze it. We will provide an overview about MACsec and its use cases before we dive in to frame structure, key distribution concepts in conjunction with their decryption possibilities in Wireshark. We will go over some example captures and take a look how to analyze them. PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/SCBU9V/ Room 1 Benjamin Pfister PUBLISH RKDKT7@@conference.wireshark.org -RKDKT7 From User to Developer en en 20261104T171500 20261104T181500 010000

From User to Developer

Many of us are using Wireshark to retrieve and analyze network traces of communication between multiple elements of our network but while many protocols are already decoded out of the box, your particular one way not be known yet. This talks walks you through the journey of such a user who took the matter in his hands to makes his life easier (and others’ in the process) then found it pleasant enough to continue. PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/RKDKT7/ Room 1 Simon Papin PUBLISH PDW7AX@@conference.wireshark.org -PDW7AX Sponsor Technology Showcase Reception, Nerd Team Trivia and Dinner en en 20261104T183000 20261104T213000 030000

Sponsor Technology Showcase Reception, Nerd Team Trivia and Dinner

PUBLIC CONFIRMED Dinner https://conference.wireshark.org/sf26eu/talk/PDW7AX/ Room 1 PUBLISH AX3RJX@@conference.wireshark.org -AX3RJX Corporate encryption challenges en en 20261104T101500 20261104T111500 010000

Corporate encryption challenges

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/AX3RJX/ Room 2 André Luyer PUBLISH CGU8JY@@conference.wireshark.org -CGU8JY TCP details that matter for the WCA Exam en en 20261104T113000 20261104T123000 010000

TCP details that matter for the WCA Exam

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/CGU8JY/ Room 2 Jasper Bongertz PUBLISH KLMHAK@@conference.wireshark.org -KLMHAK Post-Quantum Cryptography – The End of Security? en en 20261104T133000 20261104T143000 010000

Post-Quantum Cryptography – The End of Security?

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/KLMHAK/ Room 2 Johannes Weber PUBLISH ZB9ZW9@@conference.wireshark.org -ZB9ZW9 Reconsideration of perimeter security in times of GenAI en en 20261104T144500 20261104T154500 010000

Reconsideration of perimeter security in times of GenAI

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/ZB9ZW9/ Room 2 Christian Landström PUBLISH CS3YAN@@conference.wireshark.org -CS3YAN Detecting Network based Covert Channels with Wireshark en en 20261104T160000 20261104T170000 010000

Detecting Network based Covert Channels with Wireshark

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/CS3YAN/ Room 2 Daniel Spiekermann PUBLISH ZCXLSF@@conference.wireshark.org -ZCXLSF Solving Cybersecurity with JA4+ Network Fingerprinting en en 20261104T171500 20261104T181500 010000

Solving Cybersecurity with JA4+ Network Fingerprinting

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/ZCXLSF/ Room 2 John Althouse PUBLISH UQC33X@@conference.wireshark.org -UQC33X Keynote: Realizing the Closed Loop Automation en en 20261105T090000 20261105T100000 010000

Keynote: Realizing the Closed Loop Automation

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/UQC33X/ Room 1 Benoit Claise PUBLISH QFMVBK@@conference.wireshark.org -QFMVBK Does it Matter? en en 20261105T101500 20261105T111500 010000

Does it Matter?

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/QFMVBK/ Room 1 Tom Cordemans PUBLISH USXFHG@@conference.wireshark.org -USXFHG Beyond Strace: Syscall Analysis the Wireshark Way en en 20261105T113000 20261105T123000 010000

Beyond Strace: Syscall Analysis the Wireshark Way

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/USXFHG/ Room 1 Roland Knall PUBLISH 7N8Q9Q@@conference.wireshark.org -7N8Q9Q The Packet Doctors are in! Packet trace examinations with the experts en en 20261105T133000 20261105T150000 013000

The Packet Doctors are in! Packet trace examinations with the experts

PUBLIC CONFIRMED Packetdoctors Session https://conference.wireshark.org/sf26eu/talk/7N8Q9Q/ Room 1 PUBLISH T3HQTP@@conference.wireshark.org -T3HQTP More than just Ping. A closer look at ICMPv4/6. en en 20261105T151500 20261105T161500 010000

More than just Ping. A closer look at ICMPv4/6.

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/T3HQTP/ Room 1 Uli Heilmeier PUBLISH GDRHLA@@conference.wireshark.org -GDRHLA Six ways to skin a packet - capturing packets in DPDK en en 20261105T163000 20261105T173000 010000

Six ways to skin a packet - capturing packets in DPDK

The six different ways (in no particular order) are: DPDK's builtin pdump framework which is used by the tools dpdk-pdump and dpdk-dumpcap. libpcap-dpdk - integration of DPDK backend into libpcap rpcap - remote capture protocol support in DPDK; example targeted for 26.11 release grout libpcap - integration of libpcap in graph-route project netcap - eBPF trace hook support for packet capture extcap - DPDK integration with extcap; library targeted for 26.11 release Will cover all of them for comparison and do performance tests on those that are similar. PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/GDRHLA/ Room 1 Stephen Hemminger PUBLISH SJCUL7@@conference.wireshark.org -SJCUL7 How to find problems quickly in a trace file (and win the packet challenge) en en 20261105T174500 20261105T183000 004500

How to find problems quickly in a trace file (and win the packet challenge)

Returning Sharkfest attendees know, that the packet challenge is a team effort. This year, you need to regain control of a [redacted]. To complete the mission, the team has to apply elementary network forensics skills to extract data from a trace file. The challenge is build so that (hopefully) every team can solve it. This session gives you the tools to complete the challenge first and take home the price. PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/SJCUL7/ Room 1 Eddi Blenkers PUBLISH CNTVYR@@conference.wireshark.org -CNTVYR Sponsor Technology Showcase Reception, esPCAPe Group Packet Challenge and Dinner en en 20261105T183000 20261105T210000 023000

Sponsor Technology Showcase Reception, esPCAPe Group Packet Challenge and Dinner

PUBLIC CONFIRMED Dinner https://conference.wireshark.org/sf26eu/talk/CNTVYR/ Room 1 PUBLISH C9XATS@@conference.wireshark.org -C9XATS Web Vulnerabilities in Wireshark en en 20261105T101500 20261105T111500 010000

Web Vulnerabilities in Wireshark

This talk walks through the main classes where this gap shows up, using real packet captures. For each one, I'll show what the disagreement looks like in Wireshark; where the transport layer and the web layer stop telling the same story, and what the server does as a result. No prior web security knowledge needed. PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/C9XATS/ Room 2 Katherine Leese PUBLISH BEJNUY@@conference.wireshark.org -BEJNUY Attacks in the Network - A look at real world malicious traffic examples en en 20261105T113000 20261105T123000 010000

Attacks in the Network - A look at real world malicious traffic examples

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/BEJNUY/ Room 2 Jasper Bongertz PUBLISH QSQ8WN@@conference.wireshark.org -QSQ8WN 3GPP All things LTE en en 20261105T151500 20261105T161500 010000

3GPP All things LTE

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/QSQ8WN/ Room 2 Mark Stout PUBLISH JEHBPH@@conference.wireshark.org -JEHBPH AI Found Holes In Our Cheese en en 20261105T163000 20261105T173000 010000

AI Found Holes In Our Cheese

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/JEHBPH/ Room 2 Gerald Combs PUBLISH 8ZV9GX@@conference.wireshark.org -8ZV9GX SharkBytes en en 20261106T090000 20261106T100000 010000

SharkBytes

PUBLIC CONFIRMED Organization https://conference.wireshark.org/sf26eu/talk/8ZV9GX/ Room 1 PUBLISH RBVXHR@@conference.wireshark.org -RBVXHR Packets don't lie... until they do! en en 20261106T101500 20261106T111500 010000

Packets don't lie... until they do!

PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/RBVXHR/ Room 1 Sake Blok PUBLISH DBWVZS@@conference.wireshark.org -DBWVZS SharkFest group packet challenge Walkthrough en en 20261106T113000 20261106T123000 010000

SharkFest group packet challenge Walkthrough

In this years challenge, attendees recover data from a trace file to regain control over a **redacted** that is out of control. Spoiler: Data recovery is an exercise in network forensics. We will demonstrate, how Wireshark can be used to extract the relevant details. Bring your own laptop to get the most out of this session. PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/DBWVZS/ Room 1 Eddi Blenkers Sake Blok PUBLISH GW9JQG@@conference.wireshark.org -GW9JQG Wireshark With WebBrowser en en 20261106T101500 20261106T111500 010000

Wireshark With WebBrowser

You may take the longest time with the Web Browser in your computer, how about using your web browser with Wireshark? The modern web browser have many useful functions to extend Wireshark without any additional cost. In this session you can learn Wireshark enhancement with Web Browser. For example, we can use browser extensions for Wireshark, we can enrich our Wireshark visualization to make use of the web browser, and so on. PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26eu/talk/GW9JQG/ Room 2 Megumi Takeshita