Roland Knall
Sessions
The next big versions of Wireshark and Stratoshark are just around the corner. We would like to take this time to give an outlook on what those versions will bring and which new exiting new features are in the pipeline
Setting up a realistic network used to mean racks of hardware, an expensive license or a heavy VM appliance. Today a laptop is enough. This talk shows how to build complete, reproducible networks from a single YAML file with containerlab, and how to watch every packet in them live in Wireshark via Edgeshark, without installing anything beyond Docker and VS Code. Starting from an empty laptop, we deploy a small network with a client, DNS and a TLS web server, capture its traffic from any container interface, then turn it into a DHCP-driven setup and see what the protocol really does on the wire. The second half shows how the same setup becomes a training tool: faults are built into the lab on purpose, and trainees have to find them with Wireshark, the way they would in production.
Every Linux engineer knows the moment: a process is misbehaving, so you reach for strace, get a wall of text, and start grepping. It works - until the problem spans multiple processes, the output is too much to read, or you need to correlate what a process did to the system with what it did on the network. strace and bpftrace are excellent at capturing syscalls.
Stratoshark takes a different approach: it captures system calls and logs system-wide through the Falco libraries, then hands them to the same analysis engine that has served packet analysts for 25 years — display filters, coloring rules, follow-stream views, time correlation, and shareable capture files.
In this talk I'll show how a Wireshark user's instincts transfer directly to syscall troubleshooting, where Stratoshark beats reaching for strace, and where the older tools are still the right call. Real debugging scenarios, honest limitations, and a clear picture of when this newer approach earns its place in your toolbox.