Hands on Wireshark Lab and Wireshark Certified Analyst Prep
Practical Wireshark Troubleshooting is a two-day, hands-on course designed to strengthen your packet analysis and troubleshooting skills. On Day 1, Ross Bagurdes guides you through Wireshark’s key features, capture methods, filtering techniques, and foundational protocols at the Data Link and Network layers. On Day 2, Chris Greer takes you deeper into Transport and Application layer analysis, focusing on TCP, UDP, and the tools that uncover real-world performance problems. By the end, you’ll know how to approach network issues with confidence — and be better prepared for the Wireshark Certified Analyst exam.
If you have users complaining about audio issues in their Teams/Meet/Zoom calls and need to find out the reason.
- If you need to configure your network perimeter to optimally support WebRTC traffic under specific regulations
-> this class is for you.
Goal
After this class you will be able to take a capture of a WebRTC Web Conferencing call,
analyze the salient call components for potential problems and implement the required
measures in your network perimeters to overcome such problems.
After a general introduction of WebRTC we will show the use of AI tools for a quick start, and then dive into the packets.
There will be prepared captures, and a live capture sessions - but you can also bring our
own captures or capture with your specific Web conferencing tool (as long as it uses WebRTC)
SMB is the bread and butter protocol used to access file shares in virtually every company and home network. Since Windows Vista / Server 2008, the "classic" SMB has been replaced by SMB2 and later SMB3. As legacy systems running Windows XP / Server 2003 are increasingly rare, we focus on the newer version.
Based on student feedback the class from 2025 is now offered as a 2 day class. The 2 day format allows more time for practical exercises.
Hands on Wireshark Lab and Wireshark Certified Analyst Prep
Practical Wireshark Troubleshooting is a two-day, hands-on course designed to strengthen your packet analysis and troubleshooting skills. On Day 1, Ross Bagurdes guides you through Wireshark’s key features, capture methods, filtering techniques, and foundational protocols at the Data Link and Network layers. On Day 2, Chris Greer takes you deeper into Transport and Application layer analysis, focusing on TCP, UDP, and the tools that uncover real-world performance problems. By the end, you’ll know how to approach network issues with confidence — and be better prepared for the Wireshark Certified Analyst exam.
In a world of encrypted traffic and sophisticated evasion, the network remains the ultimate source of truth. Security tools may alert you that something is wrong, but the packets tell you exactly what happened on the wire.
This intensive one-day training transforms Wireshark from a simple troubleshooting tool into a powerful forensic engine. We move beyond basic protocol analysis to focus on the indicators of compromise (IoCs) and threat actor behavior hidden in plain sight. Participants will learn how to identify the subtle "heartbeats" of malware, recognize command and control (C2) patterns, and dissect behavior at various stages of an attack.
Through hands-on labs using real-world pcap datasets, we will cover:
Expert Filtering: Crafting security-focused display filters to cut through the noise.
Behavioral Analysis: Identifying anomalies in TCP/IP handshakes and DNS queries.
Actionable Reporting: Extracting evidence to build an irrefutable "proof of packet" case.
SMB is the bread and butter protocol used to access file shares in virtually every company and home network. Since Windows Vista / Server 2008, the "classic" SMB has been replaced by SMB2 and later SMB3. As legacy systems running Windows XP / Server 2003 are increasingly rare, we focus on the newer version.
Based on student feedback the class from 2025 is now offered as a 2 day class. The 2 day format allows more time for practical exercises.
Let's kick-off the conference in style!
Gerald Combs & Friends talk about the new developments over the past year
The packet stories are back with a few new cases from my work as an independent troubleshooter!
To be the network or not to be the network, that's the question!
This is a question we face a lot. The network is blamed by default, but is it really the network. During this session a couple of real life cases will be presented. What was the problem, how was it analyzed, what can we learn about the process and off course the answer to the question: was it the network?
Your company has a policy that all traffic over public internet should be Post Quantum Cryptography (PQC) ready. Or that for B2B communication Mutual-TLS (mTLS) is mandatory. How do you validate that the policy is correctly implemented?
And check for performance improvements: wat is the ratio of resumed TLS sessions, is the TLS handshake unnecessarily large, is ‘Hello Request’ or is ‘Early Data’ used?
In this session we will cover the methods of analyzing using Wireshark. Even if decryption is not allowed or hard to do.
We've all heard that Wireshark can do packet analysis. But how do you get these packets in the first place? Here we'll discuss some of the different ways packet capture actually works, to give you a deeper understanding of what you can expect to show up, and not show up, when you get to the packet analysis part. In the end, even if you don't follow all the technical details, you should have a much better grasp of the world of packet capture.
The Wireshark Certified Analyst exam is not an easy certification to take, especially if your knowledge about the details of the TCP protocol is somewhat shaky. In this talk we'll take a look at the aspects mentioned in the WCA curriculum and discuss them together. The goal is to make sure you understand what you need to bring to the exam and help you identify the areas where you might have to improve your skill analyzing TCP to achieve the WCA status.
At SharkFest '24, we introduced the fundamentals of open-source deep packet inspection (DPI) using nDPI. Since then, network adversaries and stealth VPN providers have significantly evolved, rendering traditional methods like JA4 insufficient against heavily obfuscated traffic. This 1-hour follow-up session is split into two core sections.
- We explore advanced traffic fingerprinting techniques and demonstrate how to leverage Wireshark to capture, dissect, and label complex traffic streams.
- We address what happens when fingerprinting fails against highly evasive network communications such as stealth VPNs and self-hosted AI/LLM traffic detection
- Then we will show how Wireshark data feeds into a data pipeline to train Transformer-based AI models to unmask stealth VPN/AI traffic.
- The session concludes with a live demonstration showcasing both advanced DPI extensions and the AI model detecting disguised traffic in real time.
Quantum computers have the potential to break much of the public-key cryptography that protects today's Internet. Although large-scale quantum computers do not yet exist, organisations are already preparing for the day they become a reality.
This session provides a practical introduction to Post-Quantum Cryptography (PQC). We'll separate hype from reality, explain what quantum computers can and cannot do, discuss the "Harvest Now, Decrypt Later" threat, and introduce the new generation of standardised PQC algorithms.
Finally, we'll explore where PQC is already being deployed—from TLS and IPsec to X.509 certificates and DNSSEC—and what these changes mean for network engineers, security professionals, and packet analysts. Along the way, we'll use Wireshark to examine how post-quantum cryptography appears on the wire and what to look for in real-world network captures.
Setting up a realistic network used to mean racks of hardware, an expensive license or a heavy VM appliance. Today a laptop is enough. This talk shows how to build complete, reproducible networks from a single YAML file with containerlab, and how to watch every packet in them live in Wireshark via Edgeshark, without installing anything beyond Docker and VS Code. Starting from an empty laptop, we deploy a small network with a client, DNS and a TLS web server, capture its traffic from any container interface, then turn it into a DHCP-driven setup and see what the protocol really does on the wire. The second half shows how the same setup becomes a training tool: faults are built into the lab on purpose, and trainees have to find them with Wireshark, the way they would in production.
Traditional network security, especially in the good old "perimeter" almost outlived its best practices in the last years. The ever-increasing shift to cloud deployments, cloud services, zero-trust and such led to the need to reshape, what we should think of as our perimeter and especially, what is needed in terms of visibility on the network connections at various spots inside corporate environments.
The recent huge hype around GenAI models like Mythos and others, fueled additional doom saying across the industry and enabled yet another sales wave of must-have $things which should be taken with great caution.
In this session, we will highlight the current threat modeling for perimeter security, focusing on state-of-the-art best practices and pragmatic, realistic and value-driven measures to evaluate what is really needed and how to best achieve this for staying on top of existing and emerging threats.
Corporate networks are increasingly facing internal threats as well. As a result, there is a growing demand for the encryption of all packets transmitted between switches or between end devices and switches instead of only authentication at the beginning of a session. MACsec defined in 802.1AE can offer a solution in this area. Manufacturers are now increasingly offering MACsec-compatible components and since version 4.6, Wireshark has also provided advanced analysis functions through a specialised form of decryption.
Modern network security mechanisms primarily focus on detecting known attack signatures and anomalous traffic volumes. However, network-based covert channels present a sophisticated threat by exfiltrating data and establishing Command-and-Control (C2) communication disguised as legitimate traffic. By manipulating protocol fields within standard suites—such as DNS, ICMP, or TCP headers—adversaries can bypass perimeter defenses undetected. The presentation begins with a structured introduction to the fundamentals of covert channels, establishing a theoretical foundation for their categorization and mechanics. Following this introduction, I will demonstrate practical detection methodologies directly within Wireshark using real-world traffic captures.
The story of how I came to develop in the Wireshark ecosystem after being a mere user for years and the lessons learned along the way.
In this presentation I will explain how JA4+ network fingerprinting works, the latest updates to the fingerprint family, and show you how to easily identify devices, malware, malicious servers, inbound threats and more by passively analyzing network traffic with JA4+ and without needing to break encryption. Real-world nation-state examples and war stories included.
JA4+ is free and available across a wide range of open source and vendor tools you already use including Wireshark, Zeek, Arkime, Suricata, nginx, F5, Censys, Vectra, etc.
Sponsor Showcase and Dinner
Covering the latest industry and standard trends towards closed loop in automation.
What is the most effective approach to rapidly gaining a deep understanding of a new network protocol? In this 1-hour session, the speaker will share practical experiences and lessons learned from studying the Matter protocol. In addition to an introduction to the protocol itself, the talk will focus on a structured and broadly applicable methodology for analyzing and understanding complex network protocols.
Modern web infrastructure doesn't route on IP addresses. Load balancers, proxies, and CDNs all make routing decisions based on application-layer content like Host headers, forwarding headers and request paths. This is how the web works at scale. But it creates a gap: the transport layer tells you exactly where a connection went, and above it, the web layer tells servers things the transport layer has no way to verify. I have been spending a lot of time in this territory while studying for my Burp Suite Certified Practitioner exam. The disagreement between what the IP layer says and what the web layer does is right there in a packet capture. This talk covers the main classes where the layers stop agreeing, and what each one looks like in Wireshark.
Every Linux engineer knows the moment: a process is misbehaving, so you reach for strace, get a wall of text, and start grepping. It works - until the problem spans multiple processes, the output is too much to read, or you need to correlate what a process did to the system with what it did on the network. strace and bpftrace are excellent at capturing syscalls.
Stratoshark takes a different approach: it captures system calls and logs system-wide through the Falco libraries, then hands them to the same analysis engine that has served packet analysts for 25 years — display filters, coloring rules, follow-stream views, time correlation, and shareable capture files.
In this talk I'll show how a Wireshark user's instincts transfer directly to syscall troubleshooting, where Stratoshark beats reaching for strace, and where the older tools are still the right call. Real debugging scenarios, honest limitations, and a clear picture of when this newer approach earns its place in your toolbox.
It's not easy to spot attacks in network packets, mostly because there's so many of them (packets, that is), resulting in the Signal-to-Noise ratio is extremely high. But there are also additional challenges, like encryption or attackers simply using protocols that administrators use themselves. We'll take a look at a number of real world scenarios and learn about various attack patterns and how to find/recognize them.
The experts on this panel have been asked to look at a trace file and help find a reason for certain behaviors by attendees at many SharkFests. Based on this, they’ve decided to create a public forum for examining individual trace files with a broader audience for a collective learning experience. Trace files will be gathered from attendees prior to SharkFest and only given to the panel members during the session so that the “not-
knowing what to expect and whether it can be solved” experience of working through an unknown trace file can be preserved.
Come to this session and learn to ask the right questions and look at packets in different ways.
PLEASE SEND PERPLEXING TRACE FILES FOR ANALYSIS BY THE PANEL TO [email protected] PRIOR TO SHARKFEST!
When people hear the term ‘ICMP’, most think of ‘Ping’ first. However, there are many more ICMP types and codes.
In this session, we’ll look at the most important ones, when they occur, how they can help troubleshoot issues, and which ones should be blocked and which ones shouldn’t.
We’ll also look at ICMPv6, which plays an even more important role in fundamental network functions.
Mobile networks depend on complex, multi-layered protocols for mobility management, authentication, and voice-over-LTE (VoLTE), wireless and telecom engineers heavily utilize Wireshark to troubleshoot cellular call flows. This session will cover what protocols those engineers look at on a daily basis, and how they set up wireshark, and cli to troubleshooting problems.
The Dataplane Development Kit (DPDK) is used by many proprietary and open source network infrastructure products. One limitation of the DPDK is that since it bypasses the kernel, most standard packet capture tools (such as tcpdump and wireshark) won't work as expected. I will cover six alternative ways to capture packets with DPDK and what the tradeoffs are in terms of integration, performance, and features.
This past spring, the software world was rocked by AI vulnerability storm, as the state of the art in AI vulnerability scanning advanced rapidly, and flaws were found in the software that we use every day. Wireshark wasn't spared from this, and in this talk Gerald will show how Wireshark was impacted, and the processes and tools that the development team uses to protect Wireshark from security issues.
This beginner-friendly presentation introduces you to basic Wireshark techniques to find problems quickly. This includes lesser known Wireshark features, that are super-helpful in daily network analysis.
The session also covers the team work approach to network analysis: How to coordinate the team members work and keep track of results.
Sponsor showcase, group packet challenge and dinner
SharkBytes consist of “little crunchy bits of wisdom.” Like popular TED talks, SharkBytes aim to inform, inspire, surprise, and delight by delivering a speech on a personal topic in under 5 minutes.
Information and a review of past SharkByte presentations can be found https://sharkfest.wireshark.org/sharkbytes
Email us your SharkByte session idea: [email protected]
We have all heard (and used) the phrase "Packets don't lie". We live by this mantra. And of course, packets do give evidence to the cause of sometimes complex issues. But as in evidence in criminal cases, this evidence is also subject to how it was taken and from which point of view.
This presentation will lay out many ways in which packets might not tell the truth, the whole truth and nothing but the truth.
Wireshark is now the world's most powerful packet analysis tool, and we can get more features and visualisation with your daily web browser!!
It is a time honored tradition at SharkFest, that attendees sit together in teams and solve a packet challenge as a team.
In this presentation we will walk you through this year's group packet challenge.