0.30 sf26eu 2026-11-02 2026-11-06 5 00:05 https://conference.wireshark.org Europe/Brussels Room 1 Pre Conference Class 2026-11-02T09:00:00+01:00 09:00 08:00 **Hands on Wireshark Lab and Wireshark Certified Analyst Prep** Practical Wireshark Troubleshooting is a two-day, hands-on course designed to strengthen your packet analysis and troubleshooting skills. On Day 1, Ross Bagurdes guides you through Wireshark’s key features, capture methods, filtering techniques, and foundational protocols at the Data Link and Network layers. On Day 2, Chris Greer takes you deeper into Transport and Application layer analysis, focusing on TCP, UDP, and the tools that uncover real-world performance problems. By the end, you’ll know how to approach network issues with confidence — and be better prepared for the Wireshark Certified Analyst exam. sf26eu-212-0-pre-conference-class-i-practical-wireshark-skills-for-it-professionals Pre-conference class Ross Bagurdes en Level up your Wireshark skills and get ready for Sharkfest! This hands-on course will provide core Wireshark skills for IT pros of all experience levels. Participants will gain a solid understanding of how to use Wireshark to capture, analyze, and troubleshoot network traffic. The course is designed with beginners in mind, but even seasoned packet people will pick up new tips and tricks. true https://conference.wireshark.org/sf26eu/talk/7JUZMZ/ https://conference.wireshark.org/sf26eu/talk/7JUZMZ/feedback/ Room 2 Pre Conference Class 2026-11-02T09:00:00+01:00 09:00 08:00 If you have users complaining about audio issues in their Teams/Meet/Zoom calls and need to find out the reason. - If you need to configure your network perimeter to optimally support WebRTC traffic under specific regulations -> this class is for you. **Goal** After this class you will be able to take a capture of a WebRTC Web Conferencing call, analyze the salient call components for potential problems and implement the required measures in your network perimeters to overcome such problems. After a general introduction of WebRTC we will show the use of AI tools for a quick start, and then dive into the packets. There will be prepared captures, and a live capture sessions - but you can also bring our own captures or capture with your specific Web conferencing tool (as long as it uses WebRTC) sf26eu-209-pre-conference-class-ii-webrtc-network-analysis-masterclass Intermediate Robert HessAlexander Muellrr en ## Agenda Which products use WebRTC and how are they different **Call setup in a nutshell** (explained with a capture - we use one very typical capture throughout the course) - What happens before WebRTC kicks in (Signaling, SDP) - Connectivity detection ICE/STUN/TURN - What can I optimize on client side (restrict candidates) **Analyzing the capture** - What AI can tell us about the capture - Go through the setup packet by packet and check the media flows **Media Performance** - UDP vs TCP - Packet loss & delay in a worldwide network **Doing a live capture** - Decrypt signaling - Check a few selected captures **The nasty stuff (and how to deal with it)** - Packet filters - Proxies & Zscaler - VPN & SDWAN - Reconnect times - TURN servers **What's the difference in how the various products use WebRTC** Teams Zoom Webex GotoMeeting Google Meet true https://conference.wireshark.org/sf26eu/talk/7TVPHQ/ https://conference.wireshark.org/sf26eu/talk/7TVPHQ/feedback/ Room 3 Pre Conference Class 2026-11-02T09:00:00+01:00 09:00 08:00 SMB is the bread and butter protocol used to access file shares in virtually every company and home network. Since Windows Vista / Server 2008, the "classic" SMB has been replaced by SMB2 and later SMB3. As legacy systems running Windows XP / Server 2003 are increasingly rare, we focus on the newer version. Based on student feedback the class from 2025 is now offered as a 2 day class. The 2 day format allows more time for practical exercises. sf26eu-268-0-pre-conference-class-iv-smb-masterclass Pre-conference class Eddi Blenkers en This class will enable students to investigate functional issues and performance problems. Topics covered are * SMB Handshake, selection of a dialect version and user authentication * General process of mounting a share and accessing files * Tracking SMB sessions over multiple interfaces or IP-addresses * Investigating error codes * Decryption of SMB traffic (not for the faint-hearted) * The role of Kerberos in authentication, encryption and Wireshark-based decryption * Understanding the service response time feature for SMB * Baselining application behavior for SMB file access * identification of performance bottlenecks in the network, application logic, client or server * SMB functions beyond file sharing (IPC, Named Pipes) * Identificaiton of malicious named pipes, that could be used for malware control Here is, what previous students say about the class: - Great class, good walk throu of SMB troubleshooting. I enjoyed it very much. Made a lot of things i struggled with earlier a lot clearer to me. - It was fantastic! I now definitely have a better overview over what SMB is doing. - Great and awesome deep dive!!! true https://conference.wireshark.org/sf26eu/talk/VKPWM3/ https://conference.wireshark.org/sf26eu/talk/VKPWM3/feedback/ Room 1 Pre Conference Class 2026-11-03T09:00:00+01:00 09:00 08:00 **Hands on Wireshark Lab and Wireshark Certified Analyst Prep** Practical Wireshark Troubleshooting is a two-day, hands-on course designed to strengthen your packet analysis and troubleshooting skills. On Day 1, Ross Bagurdes guides you through Wireshark’s key features, capture methods, filtering techniques, and foundational protocols at the Data Link and Network layers. On Day 2, Chris Greer takes you deeper into Transport and Application layer analysis, focusing on TCP, UDP, and the tools that uncover real-world performance problems. By the end, you’ll know how to approach network issues with confidence — and be better prepared for the Wireshark Certified Analyst exam. sf26eu-212-1-pre-conference-class-i-practical-wireshark-skills-for-it-professionals Pre-conference class Ross Bagurdes en Level up your Wireshark skills and get ready for Sharkfest! This hands-on course will provide core Wireshark skills for IT pros of all experience levels. Participants will gain a solid understanding of how to use Wireshark to capture, analyze, and troubleshoot network traffic. The course is designed with beginners in mind, but even seasoned packet people will pick up new tips and tricks. true https://conference.wireshark.org/sf26eu/talk/7JUZMZ/ https://conference.wireshark.org/sf26eu/talk/7JUZMZ/feedback/ Room 1 Dinner 2026-11-03T17:30:00+01:00 17:30 03:00 Let's kick-off the conference in style! sf26eu-213-sharkfest-26-europe-welcome-dinner-sponsor-showcase Organization en false https://conference.wireshark.org/sf26eu/talk/XBMHVL/ https://conference.wireshark.org/sf26eu/talk/XBMHVL/feedback/ Room 2 Pre Conference Class 2026-11-03T09:00:00+01:00 09:00 08:00 In a world of encrypted traffic and sophisticated evasion, the network remains the ultimate source of truth. Security tools may alert you that something is wrong, but the packets tell you exactly what happened on the wire. This intensive one-day training transforms Wireshark from a simple troubleshooting tool into a powerful forensic engine. We move beyond basic protocol analysis to focus on the indicators of compromise (IoCs) and threat actor behavior hidden in plain sight. Participants will learn how to identify the subtle "heartbeats" of malware, recognize command and control (C2) patterns, and dissect behavior at various stages of an attack. Through hands-on labs using real-world pcap datasets, we will cover: Expert Filtering: Crafting security-focused display filters to cut through the noise. Behavioral Analysis: Identifying anomalies in TCP/IP handshakes and DNS queries. Actionable Reporting: Extracting evidence to build an irrefutable "proof of packet" case. sf26eu-211-pre-conference-class-iii-the-proof-is-in-the-packets-network-threat-detection-using-wireshark Security Marcelle Lee en false https://conference.wireshark.org/sf26eu/talk/3PDG9V/ https://conference.wireshark.org/sf26eu/talk/3PDG9V/feedback/ Room 3 Pre Conference Class 2026-11-03T09:00:00+01:00 09:00 08:00 SMB is the bread and butter protocol used to access file shares in virtually every company and home network. Since Windows Vista / Server 2008, the "classic" SMB has been replaced by SMB2 and later SMB3. As legacy systems running Windows XP / Server 2003 are increasingly rare, we focus on the newer version. Based on student feedback the class from 2025 is now offered as a 2 day class. The 2 day format allows more time for practical exercises. sf26eu-268-1-pre-conference-class-iv-smb-masterclass Pre-conference class Eddi Blenkers en This class will enable students to investigate functional issues and performance problems. Topics covered are * SMB Handshake, selection of a dialect version and user authentication * General process of mounting a share and accessing files * Tracking SMB sessions over multiple interfaces or IP-addresses * Investigating error codes * Decryption of SMB traffic (not for the faint-hearted) * The role of Kerberos in authentication, encryption and Wireshark-based decryption * Understanding the service response time feature for SMB * Baselining application behavior for SMB file access * identification of performance bottlenecks in the network, application logic, client or server * SMB functions beyond file sharing (IPC, Named Pipes) * Identificaiton of malicious named pipes, that could be used for malware control Here is, what previous students say about the class: - Great class, good walk throu of SMB troubleshooting. I enjoyed it very much. Made a lot of things i struggled with earlier a lot clearer to me. - It was fantastic! I now definitely have a better overview over what SMB is doing. - Great and awesome deep dive!!! true https://conference.wireshark.org/sf26eu/talk/VKPWM3/ https://conference.wireshark.org/sf26eu/talk/VKPWM3/feedback/ Room 1 Organization 2026-11-04T09:00:00+01:00 09:00 01:00 Gerald Combs & Friends talk about the new developments over the past year sf26eu-216-keynote-things-i-love-about-wireshark-and-maybe-a-couple-of-things-i-don-t Organization en false https://conference.wireshark.org/sf26eu/talk/FH9DSQ/ https://conference.wireshark.org/sf26eu/talk/FH9DSQ/feedback/ Room 1 Presentation 2026-11-04T10:15:00+01:00 10:15 01:00 _The packet stories are back with a few new cases from my work as an independent troubleshooter!_ **_To be the network or not to be the network, that's the question!_** This is a question we face a lot. The network is blamed by default, but is it really the network. During this session a couple of real life cases will be presented. What was the problem, how was it analyzed, what can we learn about the process and off course the answer to the question: was it the network? sf26eu-245-packet-stories-2 Intermediate Sake Blok en false https://conference.wireshark.org/sf26eu/talk/AHJB7N/ https://conference.wireshark.org/sf26eu/talk/AHJB7N/feedback/ Room 1 Presentation 2026-11-04T11:30:00+01:00 11:30 01:00 We've all heard that Wireshark can do packet analysis. But how do you get these packets in the first place? Here we'll discuss some of the different ways packet capture actually works, to give you a deeper understanding of what you can expect to show up, and not show up, when you get to the packet analysis part. In the end, even if you don't follow all the technical details, you should have a much better grasp of the world of packet capture. sf26eu-282-packet-capture-basics-how-do-you-get-em Beginner Jaap Keuter en false https://conference.wireshark.org/sf26eu/talk/7ELU8V/ https://conference.wireshark.org/sf26eu/talk/7ELU8V/feedback/ Room 1 Presentation 2026-11-04T13:30:00+01:00 13:30 01:00 At SharkFest '24, we introduced the fundamentals of open-source deep packet inspection (DPI) using nDPI. Since then, network adversaries and stealth VPN providers have significantly evolved, rendering traditional methods like JA4 insufficient against heavily obfuscated traffic. This 1-hour follow-up session is split into two core sections. - We explore advanced traffic fingerprinting techniques and demonstrate how to leverage Wireshark to capture, dissect, and label complex traffic streams. - We address what happens when fingerprinting fails against highly evasive network communications such as stealth VPNs and self-hosted AI/LLM traffic detection - Then we will show how Wireshark data feeds into a data pipeline to train Transformer-based AI models to unmask stealth VPN/AI traffic. - The session concludes with a live demonstration showcasing both advanced DPI extensions and the AI model detecting disguised traffic in real time. sf26eu-238-transformers-in-the-wire-advanced-dpi-fingerprinting-for-ai-stealth-vpn-detection Intermediate Luca DeriDaniele Sartiano en false https://conference.wireshark.org/sf26eu/talk/R9PZDM/ https://conference.wireshark.org/sf26eu/talk/R9PZDM/feedback/ Room 1 Presentation 2026-11-04T14:45:00+01:00 14:45 01:00 Setting up a realistic network used to mean racks of hardware, an expensive license or a heavy VM appliance. Today a laptop is enough. This talk shows how to build complete, reproducible networks from a single YAML file with containerlab, and how to watch every packet in them live in Wireshark via Edgeshark, without installing anything beyond Docker and VS Code. Starting from an empty laptop, we deploy a small network with a client, DNS and a TLS web server, capture its traffic from any container interface, then turn it into a DHCP-driven setup and see what the protocol really does on the wire. The second half shows how the same setup becomes a training tool: faults are built into the lab on purpose, and trainees have to find them with Wireshark, the way they would in production. sf26eu-275-build-a-datacenter-on-your-laptop-an-introduction-and-realtime-examples-of-simulated-networks Beginner Roland Knall en A network lab no longer needs a rack or heavy VM appliances. With containerlab, a topology is a YAML file: nodes, links, addresses and startup commands, versioned in Git and deployed in seconds. Every node is a Linux container wired with veth pairs, so the traffic is real kernel networking – nothing simulated, everything open to packet analysis. Build it: starting from a clean laptop with VS Code and Docker, we deploy a client, a DNS server and a TLS web server, look at what containerlab creates underneath, and hit the typical day-one traps: subnet clashes, devcontainer path issues, missing return routes. See it: we compare four ways to capture inside containers, ending with Edgeshark, which lists every container interface in the browser and opens a live capture in your local Wireshark with one click. Live: DNS lookup, TCP handshake, a TLS Client Hello leaking the server name, and the same session decrypted with SSLKEYLOGFILE. Evolve it: the lab moves from static addresses to DHCP. We follow DISCOVER, OFFER, REQUEST and ACK and inspect the options up to Option 121 – and see that DHCP options are offers the client may ignore. Train with it: each training scenario is a topology file with a deliberate fault – a missing route, an overridden resolver, an ignored DHCP option. Trainees get a symptom ("the website doesn't load") and work down to the cause with Wireshark. Every trainee gets an identical lab, resets take seconds, and the fix is a one-line change. Takeaways: a running multi-node network in minutes, a capture workflow for containers that feels local, a method for building troubleshooting trainings from version-controlled labs, and an honest look at where container networks differ from real hardware. For network engineers, analysts and trainers who know Wireshark. No containerlab experience needed. false https://conference.wireshark.org/sf26eu/talk/7TY7ZF/ https://conference.wireshark.org/sf26eu/talk/7TY7ZF/feedback/ Room 1 Presentation 2026-11-04T16:00:00+01:00 16:00 01:00 Corporate networks are increasingly facing internal threats as well. As a result, there is a growing demand for the encryption of all packets transmitted between switches or between end devices and switches instead of only authentication at the beginning of a session. MACsec defined in 802.1AE can offer a solution in this area. Manufacturers are now increasingly offering MACsec-compatible components and since version 4.6, Wireshark has also provided advanced analysis functions through a specialised form of decryption. sf26eu-253-macsec-protocol-overview-and-analysis Intermediate Benjamin Pfister en MACsec was defined in 2006, but its prevalence has only been rising in recent years. It can provide Hop-by-Hop Encryption in Line-Rate between Switches or between Hosts and Switches. So analysts are looking for ways to analyze it. We will provide an overview about MACsec and its use cases before we dive in to frame structure, key distribution concepts in conjunction with their decryption possibilities in Wireshark. We will go over some example captures and take a look how to analyze them. false https://conference.wireshark.org/sf26eu/talk/SCBU9V/ https://conference.wireshark.org/sf26eu/talk/SCBU9V/feedback/ Room 1 Presentation 2026-11-04T17:15:00+01:00 17:15 01:00 The story of how I came to develop in the Wireshark ecosystem after being a mere user for years and the lessons learned along the way. sf26eu-267-from-user-to-developer Intermediate Simon Papin en Many of us are using Wireshark to retrieve and analyze network traces of communication between multiple elements of our network but while many protocols are already decoded out of the box, your particular one way not be known yet. This talks walks you through the journey of such a user who took the matter in his hands to makes his life easier (and others’ in the process) then found it pleasant enough to continue. true https://conference.wireshark.org/sf26eu/talk/RKDKT7/ https://conference.wireshark.org/sf26eu/talk/RKDKT7/feedback/ Room 1 Dinner 2026-11-04T18:30:00+01:00 18:30 03:00 Sponsor Showcase and Dinner sf26eu-214-sponsor-technology-showcase-reception-nerd-team-trivia-and-dinner Organization en false https://conference.wireshark.org/sf26eu/talk/PDW7AX/ https://conference.wireshark.org/sf26eu/talk/PDW7AX/feedback/ Room 2 Presentation 2026-11-04T10:15:00+01:00 10:15 01:00 Your company has a policy that all traffic over public internet should be Post Quantum Cryptography (PQC) ready. Or that for B2B communication Mutual-TLS (mTLS) is mandatory. How do you validate that the policy is correctly implemented? And check for performance improvements: wat is the ratio of resumed TLS sessions, is the TLS handshake unnecessarily large, is ‘Hello Request’ or is ‘Early Data’ used? In this session we will cover the methods of analyzing using Wireshark. Even if decryption is not allowed or hard to do. sf26eu-236-corporate-encryption-challenges Expert / Developer André Luyer en false https://conference.wireshark.org/sf26eu/talk/AX3RJX/ https://conference.wireshark.org/sf26eu/talk/AX3RJX/feedback/ Room 2 Presentation 2026-11-04T11:30:00+01:00 11:30 01:00 The Wireshark Certified Analyst exam is not an easy certification to take, especially if your knowledge about the details of the TCP protocol is somewhat shaky. In this talk we'll take a look at the aspects mentioned in the WCA curriculum and discuss them together. The goal is to make sure you understand what you need to bring to the exam and help you identify the areas where you might have to improve your skill analyzing TCP to achieve the WCA status. sf26eu-276-tcp-details-that-matter-for-the-wca-exam Expert / Developer Jasper Bongertz en false https://conference.wireshark.org/sf26eu/talk/CGU8JY/ https://conference.wireshark.org/sf26eu/talk/CGU8JY/feedback/ Room 2 Presentation 2026-11-04T13:30:00+01:00 13:30 01:00 Quantum computers have the potential to break much of the public-key cryptography that protects today's Internet. Although large-scale quantum computers do not yet exist, organisations are already preparing for the day they become a reality. This session provides a practical introduction to Post-Quantum Cryptography (PQC). We'll separate hype from reality, explain what quantum computers can and cannot do, discuss the "Harvest Now, Decrypt Later" threat, and introduce the new generation of standardised PQC algorithms. Finally, we'll explore where PQC is already being deployed—from TLS and IPsec to X.509 certificates and DNSSEC—and what these changes mean for network engineers, security professionals, and packet analysts. Along the way, we'll use Wireshark to examine how post-quantum cryptography appears on the wire and what to look for in real-world network captures. sf26eu-265-post-quantum-cryptography-the-end-of-security Security Johannes Weber en false https://conference.wireshark.org/sf26eu/talk/KLMHAK/ https://conference.wireshark.org/sf26eu/talk/KLMHAK/feedback/ Room 2 Presentation 2026-11-04T14:45:00+01:00 14:45 01:00 Traditional network security, especially in the good old "perimeter" almost outlived its best practices in the last years. The ever-increasing shift to cloud deployments, cloud services, zero-trust and such led to the need to reshape, what we should think of as our perimeter and especially, what is needed in terms of visibility on the network connections at various spots inside corporate environments. The recent huge hype around GenAI models like Mythos and others, fueled additional doom saying across the industry and enabled yet another sales wave of must-have $things which should be taken with great caution. In this session, we will highlight the current threat modeling for perimeter security, focusing on state-of-the-art best practices and pragmatic, realistic and value-driven measures to evaluate what is really needed and how to best achieve this for staying on top of existing and emerging threats. sf26eu-254-reconsideration-of-perimeter-security-in-times-of-genai Security Christian Landström en true https://conference.wireshark.org/sf26eu/talk/ZB9ZW9/ https://conference.wireshark.org/sf26eu/talk/ZB9ZW9/feedback/ Room 2 Presentation 2026-11-04T16:00:00+01:00 16:00 01:00 Modern network security mechanisms primarily focus on detecting known attack signatures and anomalous traffic volumes. However, network-based covert channels present a sophisticated threat by exfiltrating data and establishing Command-and-Control (C2) communication disguised as legitimate traffic. By manipulating protocol fields within standard suites—such as DNS, ICMP, or TCP headers—adversaries can bypass perimeter defenses undetected. The presentation begins with a structured introduction to the fundamentals of covert channels, establishing a theoretical foundation for their categorization and mechanics. Following this introduction, I will demonstrate practical detection methodologies directly within Wireshark using real-world traffic captures. sf26eu-266-detecting-network-based-covert-channels-with-wireshark Security Daniel Spiekermann en true https://conference.wireshark.org/sf26eu/talk/CS3YAN/ https://conference.wireshark.org/sf26eu/talk/CS3YAN/feedback/ Room 2 Presentation 2026-11-04T17:15:00+01:00 17:15 01:00 In this presentation I will explain how JA4+ network fingerprinting works, the latest updates to the fingerprint family, and show you how to easily identify devices, malware, malicious servers, inbound threats and more by passively analyzing network traffic with JA4+ and without needing to break encryption. Real-world nation-state examples and war stories included. JA4+ is free and available across a wide range of open source and vendor tools you already use including Wireshark, Zeek, Arkime, Suricata, nginx, F5, Censys, Vectra, etc. sf26eu-278-solving-cybersecurity-with-ja4-network-fingerprinting Security John Althouse en false https://conference.wireshark.org/sf26eu/talk/ZCXLSF/ https://conference.wireshark.org/sf26eu/talk/ZCXLSF/feedback/ Room 1 Presentation 2026-11-05T09:00:00+01:00 09:00 01:00 Covering the latest industry and standard trends towards closed loop in automation. sf26eu-271-keynote-realizing-the-closed-loop-automation Intermediate Benoit Claise en false https://conference.wireshark.org/sf26eu/talk/UQC33X/ https://conference.wireshark.org/sf26eu/talk/UQC33X/feedback/ Room 1 Presentation 2026-11-05T10:15:00+01:00 10:15 01:00 What is the most effective approach to rapidly gaining a deep understanding of a new network protocol? In this 1-hour session, the speaker will share practical experiences and lessons learned from studying the Matter protocol. In addition to an introduction to the protocol itself, the talk will focus on a structured and broadly applicable methodology for analyzing and understanding complex network protocols. sf26eu-230-does-it-matter Beginner Tom Cordemans en false https://conference.wireshark.org/sf26eu/talk/QFMVBK/ https://conference.wireshark.org/sf26eu/talk/QFMVBK/feedback/ Room 1 Presentation 2026-11-05T11:30:00+01:00 11:30 01:00 Every Linux engineer knows the moment: a process is misbehaving, so you reach for strace, get a wall of text, and start grepping. It works - until the problem spans multiple processes, the output is too much to read, or you need to correlate what a process did to the system with what it did on the network. strace and bpftrace are excellent at capturing syscalls. Stratoshark takes a different approach: it captures system calls and logs system-wide through the Falco libraries, then hands them to the same analysis engine that has served packet analysts for 25 years — display filters, coloring rules, follow-stream views, time correlation, and shareable capture files. In this talk I'll show how a Wireshark user's instincts transfer directly to syscall troubleshooting, where Stratoshark beats reaching for strace, and where the older tools are still the right call. Real debugging scenarios, honest limitations, and a clear picture of when this newer approach earns its place in your toolbox. sf26eu-281-beyond-strace-syscall-analysis-the-wireshark-way Intermediate Roland Knall en false https://conference.wireshark.org/sf26eu/talk/USXFHG/ https://conference.wireshark.org/sf26eu/talk/USXFHG/feedback/ Room 1 Packetdoctors Session 2026-11-05T13:30:00+01:00 13:30 01:30 The experts on this panel have been asked to look at a trace file and help find a reason for certain behaviors by attendees at many SharkFests. Based on this, they’ve decided to create a public forum for examining individual trace files with a broader audience for a collective learning experience. Trace files will be gathered from attendees prior to SharkFest and only given to the panel members during the session so that the “not- knowing what to expect and whether it can be solved” experience of working through an unknown trace file can be preserved. Come to this session and learn to ask the right questions and look at packets in different ways. PLEASE SEND PERPLEXING TRACE FILES FOR ANALYSIS BY THE PANEL TO jasper@packet-foo.com PRIOR TO SHARKFEST! sf26eu-217-the-packet-doctors-are-in-packet-trace-examinations-with-the-experts en false https://conference.wireshark.org/sf26eu/talk/7N8Q9Q/ https://conference.wireshark.org/sf26eu/talk/7N8Q9Q/feedback/ Room 1 Presentation 2026-11-05T15:15:00+01:00 15:15 01:00 When people hear the term ‘ICMP’, most think of ‘Ping’ first. However, there are many more ICMP types and codes. In this session, we’ll look at the most important ones, when they occur, how they can help troubleshoot issues, and which ones should be blocked and which ones shouldn’t. We’ll also look at ICMPv6, which plays an even more important role in fundamental network functions. sf26eu-269-more-than-just-ping-a-closer-look-at-icmpv4-6 Intermediate Uli Heilmeier en false https://conference.wireshark.org/sf26eu/talk/T3HQTP/ https://conference.wireshark.org/sf26eu/talk/T3HQTP/feedback/ Room 1 Presentation 2026-11-05T16:30:00+01:00 16:30 01:00 The Dataplane Development Kit (DPDK) is used by many proprietary and open source network infrastructure products. One limitation of the DPDK is that since it bypasses the kernel, most standard packet capture tools (such as tcpdump and wireshark) won't work as expected. I will cover six alternative ways to capture packets with DPDK and what the tradeoffs are in terms of integration, performance, and features. sf26eu-248-six-ways-to-skin-a-packet-capturing-packets-in-dpdk Intermediate /media/sf26eu/submissions/GDRHLA/image_WdkCqT0.webp Stephen Hemminger en The six different ways (in no particular order) are: DPDK's builtin pdump framework which is used by the tools dpdk-pdump and dpdk-dumpcap. libpcap-dpdk - integration of DPDK backend into libpcap rpcap - remote capture protocol support in DPDK; example targeted for 26.11 release grout libpcap - integration of libpcap in graph-route project netcap - eBPF trace hook support for packet capture extcap - DPDK integration with extcap; library targeted for 26.11 release Will cover all of them for comparison and do performance tests on those that are similar. false https://conference.wireshark.org/sf26eu/talk/GDRHLA/ https://conference.wireshark.org/sf26eu/talk/GDRHLA/feedback/ Room 1 Presentation 2026-11-05T17:45:00+01:00 17:45 00:45 This beginner-friendly presentation introduces you to basic Wireshark techniques to find problems quickly. This includes lesser known Wireshark features, that are super-helpful in daily network analysis. The session also covers the team work approach to network analysis: How to coordinate the team members work and keep track of results. sf26eu-270-how-to-find-problems-quickly-in-a-trace-file-and-win-the-packet-challenge Beginner Eddi Blenkers en Returning Sharkfest attendees know, that the packet challenge is a team effort. This year, you need to regain control of a [redacted]. To complete the mission, the team has to apply elementary network forensics skills to extract data from a trace file. The challenge is build so that (hopefully) every team can solve it. This session gives you the tools to complete the challenge first and take home the price. true https://conference.wireshark.org/sf26eu/talk/SJCUL7/ https://conference.wireshark.org/sf26eu/talk/SJCUL7/feedback/ Room 1 Dinner 2026-11-05T18:30:00+01:00 18:30 02:30 Sponsor showcase, group packet challenge and dinner sf26eu-264-sponsor-technology-showcase-reception-espcape-group-packet-challenge-and-dinner en false https://conference.wireshark.org/sf26eu/talk/CNTVYR/ https://conference.wireshark.org/sf26eu/talk/CNTVYR/feedback/ Room 2 Presentation 2026-11-05T10:15:00+01:00 10:15 01:00 Modern web infrastructure doesn't route on IP addresses. Load balancers, proxies, and CDNs all make routing decisions based on application-layer content like Host headers, forwarding headers and request paths. This is how the web works at scale. But it creates a gap: the transport layer tells you exactly where a connection went, and above it, the web layer tells servers things the transport layer has no way to verify. I have been spending a lot of time in this territory while studying for my Burp Suite Certified Practitioner exam. The disagreement between what the IP layer says and what the web layer does is right there in a packet capture. This talk covers the main classes where the layers stop agreeing, and what each one looks like in Wireshark. sf26eu-272-web-vulnerabilities-in-wireshark Security Katherine Leese en This talk walks through the main classes where this gap shows up, using real packet captures. For each one, I'll show what the disagreement looks like in Wireshark; where the transport layer and the web layer stop telling the same story, and what the server does as a result. No prior web security knowledge needed. false https://conference.wireshark.org/sf26eu/talk/C9XATS/ https://conference.wireshark.org/sf26eu/talk/C9XATS/feedback/ Room 2 Presentation 2026-11-05T11:30:00+01:00 11:30 01:00 It's not easy to spot attacks in network packets, mostly because there's so many of them (packets, that is), resulting in the Signal-to-Noise ratio is extremely high. But there are also additional challenges, like encryption or attackers simply using protocols that administrators use themselves. We'll take a look at a number of real world scenarios and learn about various attack patterns and how to find/recognize them. sf26eu-280-attacks-in-the-network-a-look-at-real-world-malicious-traffic-examples Security Jasper Bongertz en false https://conference.wireshark.org/sf26eu/talk/BEJNUY/ https://conference.wireshark.org/sf26eu/talk/BEJNUY/feedback/ Room 2 Presentation 2026-11-05T15:15:00+01:00 15:15 01:00 Mobile networks depend on complex, multi-layered protocols for mobility management, authentication, and voice-over-LTE (VoLTE), wireless and telecom engineers heavily utilize Wireshark to troubleshoot cellular call flows. This session will cover what protocols those engineers look at on a daily basis, and how they set up wireshark, and cli to troubleshooting problems. sf26eu-277-3gpp-all-things-lte Intermediate Mark Stout en false https://conference.wireshark.org/sf26eu/talk/QSQ8WN/ https://conference.wireshark.org/sf26eu/talk/QSQ8WN/feedback/ Room 2 Presentation 2026-11-05T16:30:00+01:00 16:30 01:00 This past spring, the software world was rocked by AI vulnerability storm, as the state of the art in AI vulnerability scanning advanced rapidly, and flaws were found in the software that we use every day. Wireshark wasn't spared from this, and in this talk Gerald will show how Wireshark was impacted, and the processes and tools that the development team uses to protect Wireshark from security issues. sf26eu-279-ai-found-holes-in-our-cheese Security Gerald Combs en false https://conference.wireshark.org/sf26eu/talk/JEHBPH/ https://conference.wireshark.org/sf26eu/talk/JEHBPH/feedback/ Room 1 Organization 2026-11-06T09:00:00+01:00 09:00 01:00 SharkBytes consist of “little crunchy bits of wisdom.” Like popular TED talks, SharkBytes aim to inform, inspire, surprise, and delight by delivering a speech on a personal topic in under 5 minutes. Information and a review of past SharkByte presentations can be found https://sharkfest.wireshark.org/sharkbytes Email us your SharkByte session idea: sharkfest@wireshark.org sf26eu-215-sharkbytes Organization en false https://conference.wireshark.org/sf26eu/talk/8ZV9GX/ https://conference.wireshark.org/sf26eu/talk/8ZV9GX/feedback/ Room 1 Presentation 2026-11-06T10:15:00+01:00 10:15 01:00 We have all heard (and used) the phrase "Packets don't lie". We live by this mantra. And of course, packets do give evidence to the cause of sometimes complex issues. But as in evidence in criminal cases, this evidence is also subject to how it was taken and from which point of view. This presentation will lay out many ways in which packets might not tell the truth, the whole truth and nothing but the truth. sf26eu-244-packets-don-t-lie-until-they-do Intermediate Sake Blok en false https://conference.wireshark.org/sf26eu/talk/RBVXHR/ https://conference.wireshark.org/sf26eu/talk/RBVXHR/feedback/ Room 1 Presentation 2026-11-06T11:30:00+01:00 11:30 01:00 It is a time honored tradition at SharkFest, that attendees sit together in teams and solve a packet challenge as a team. In this presentation we will walk you through this year's group packet challenge. sf26eu-263-sharkfest-group-packet-challenge-walkthrough Beginner Eddi BlenkersSake Blok en In this years challenge, attendees recover data from a trace file to regain control over a **redacted** that is out of control. Spoiler: Data recovery is an exercise in network forensics. We will demonstrate, how Wireshark can be used to extract the relevant details. Bring your own laptop to get the most out of this session. true https://conference.wireshark.org/sf26eu/talk/DBWVZS/ https://conference.wireshark.org/sf26eu/talk/DBWVZS/feedback/ Room 2 Presentation 2026-11-06T10:15:00+01:00 10:15 01:00 Wireshark is now the world's most powerful packet analysis tool, and we can get more features and visualisation with your daily web browser!! sf26eu-233-wireshark-with-webbrowser Intermediate Megumi Takeshita en You may take the longest time with the Web Browser in your computer, how about using your web browser with Wireshark? The modern web browser have many useful functions to extend Wireshark without any additional cost. In this session you can learn Wireshark enhancement with Web Browser. For example, we can use browser extensions for Wireshark, we can enrich our Wireshark visualization to make use of the web browser, and so on. false https://conference.wireshark.org/sf26eu/talk/GW9JQG/ https://conference.wireshark.org/sf26eu/talk/GW9JQG/feedback/