{"$schema": "https://c3voc.de/schedule/schema.json", "generator": {"name": "pretalx", "version": "2026.1.2"}, "schedule": {"url": "https://conference.wireshark.org/sf26us/schedule/", "version": "2026-03-57", "base_url": "https://conference.wireshark.org", "conference": {"acronym": "sf26us", "title": "SharkFest'26 US", "start": "2026-07-18", "end": "2026-07-23", "daysCount": 6, "timeslot_duration": "00:05", "time_zone_name": "America/Chicago", "colors": {"primary": "#1e74b9"}, "rooms": [{"name": "Hermitage ABC | General Session", "slug": "11-hermitage-abc-general-session", "guid": "91d4d02b-7495-5eb4-946a-6a24e4f87481", "description": null, "capacity": null}, {"name": "Hermitage D | Classroom", "slug": "12-hermitage-d-classroom", "guid": "a25c3679-1842-5652-94a2-5218804e6fd8", "description": null, "capacity": 80}], "tracks": [{"name": "Beginner", "slug": "30-beginner", "color": "#00AB9B"}, {"name": "Intermediate", "slug": "31-intermediate", "color": "#2B9ECF"}, {"name": "Expert / Developer", "slug": "32-expert-developer", "color": "#9D6DEC"}, {"name": "Security", "slug": "33-security", "color": "#72B406"}, {"name": "A.I.", "slug": "34-ai", "color": "#E60757"}, {"name": "Pre-conference class", "slug": "35-pre-conference-class", "color": "#0C590D"}, {"name": "Organization", "slug": "36-organization", "color": "#3C8BC4"}], "days": [{"index": 1, "date": "2026-07-18", "day_start": "2026-07-18T04:00:00-05:00", "day_end": "2026-07-19T03:59:00-05:00", "rooms": {"Hermitage ABC | General Session": [{"guid": "415214cc-a53e-527d-a081-f1edb959abff", "code": "BSA8P7", "id": 189, "logo": null, "date": "2026-07-18T09:00:00-05:00", "start": "09:00", "duration": "08:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-189-0-pre-conference-class-i-practical-wireshark-skills-for-it-professionals", "url": "https://conference.wireshark.org/sf26us/talk/BSA8P7/", "title": "Pre-Conference Class I: Practical Wireshark Skills for IT professionals", "subtitle": "", "track": "Pre-conference class", "type": "Pre Conference Class", "language": "en", "abstract": "**Hands on Wireshark Lab and Wireshark Certified Analyst Prep**\r\n\r\nPractical Wireshark Troubleshooting is a two-day, hands-on course designed to strengthen your packet analysis and troubleshooting skills. On Day 1, Ross Bagurdes guides you through Wireshark\u2019s key features, capture methods, filtering techniques, and foundational protocols at the Data Link and Network layers. On Day 2, Chris Greer takes you deeper into Transport and Application layer analysis, focusing on TCP, UDP, and the tools that uncover real-world performance problems. By the end, you\u2019ll know how to approach network issues with confidence \u2014 and be better prepared for the Wireshark Certified Analyst exam.", "description": "Level up your Wireshark skills and get ready for Sharkfest! This hands-on course will provide core Wireshark skills for IT pros of all experience levels. Participants will gain a solid understanding of how to use Wireshark to capture, analyze, and troubleshoot network traffic. The course is designed with beginners in mind, but even seasoned packet people will pick up new tips and tricks.", "recording_license": "", "do_not_record": true, "persons": [{"code": "PXMJ8G", "name": "Chris Greer", "avatar": "https://conference.wireshark.org/media/avatars/Chris_New_mug_K5fG1wf.png", "biography": "Like you, Chris likes digging into packet captures to figure out how things work. When he is not teaching people the art of packet analysis in live courses, YouTube videos, or at conference seminars, you can find him in the packet trenches with clients from all over the world. Chris has been attending and speaking at Sharkfest since 2011 and enjoys learning new things right alongside attendees of all experience levels.", "public_name": "Chris Greer", "guid": "0c68084e-3d29-5ef1-8b33-42e9bdef9f99", "url": "https://conference.wireshark.org/sf26us/speaker/PXMJ8G/"}, {"code": "NNQ7UM", "name": "Ross Bagurdes", "avatar": null, "biography": "Ross has had a diverse career in engineering, beginning as a structural engineer, then project engineer for a gas utility, Ross was always quickly\r\nassigned the de-facto network administrator, typically after no one else was brave enough to break, and later fix, the network. This lead to working as a network engineer designing and implementing enterprise networks for a major university hospital. Here he worked with\r\nExtreme Networks, HP, Cisco, Tipping Point, among other network technology, as well as honed his Wireshark and protocol analysis skills. Ross\r\nspent 7 years teaching data networking at Madison College, and in 2017 started authoring and producing IT training videos in Wireshark/Protocol\r\nAnalysis, Cisco, and general networking topics for www.Pluralsight.com. In his free time, you'll find Ross and his dog at the beach swimming and\r\nsurfing, traveling, hiking, or snowboarding somewhere in the western US.", "public_name": "Ross Bagurdes", "guid": "3935f6fc-0f65-5cda-b7bb-b235f5b36c5f", "url": "https://conference.wireshark.org/sf26us/speaker/NNQ7UM/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/BSA8P7/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/BSA8P7/", "attachments": []}, {"guid": "e2aee2d8-deac-55d5-b503-19706d7921ba", "code": "FYWGV9", "id": 197, "logo": "https://conference.wireshark.org/media/sf26us/submissions/FYWGV9/shark_waci_j4GEXty.png", "date": "2026-07-18T17:00:00-05:00", "start": "17:00", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-197-0-feeding-frenzy-of-wild-ideas-when-sharks-brainstorm", "url": "https://conference.wireshark.org/sf26us/talk/FYWGV9/", "title": "Feeding Frenzy of Wild Ideas: When Sharks Brainstorm", "subtitle": "", "track": "Beginner", "type": "Organization", "language": "en", "abstract": "Innovation doesn\u2019t always start with a perfectly reasonable idea\u2014sometimes it starts with something gloriously absurd. This session invites both developers and users to surface their most unconventional, impractical, or outright bizarre ideas for Wireshark and packet analysis. Nothing is too silly, too quirky, or too infeasible to share.\r\n\r\nBy creating a space free of judgment and full of curiosity, we open the door to unexpected breakthroughs. 99 wild suggestions may go nowhere\u2026 but the 100th can trigger a spark that becomes a feature, a tool, or even a whole new product direction.\r\nJoin us for an hour where creativity takes the wheel, seriousness stays at the shore, and every idea\u2014no matter how ridiculous\u2014gets its moment in the water.\r\n\r\nThis is open-house / open-door. Just come in and have some fun throwing ideas around", "description": "*Goal:*\r\nGenerate offbeat, humorous, impossible or \u201cwhy would anyone even\u2026\u201d suggestions that just might reveal a surprisingly valuable insight for Wireshark\u2019s future capabilities.\r\n\r\n*Format:*\r\n* Why absurd ideas matter.\r\n* Warm Up\r\n* Open SharkTank\r\n* The \u2018Maybe\u2026\u2019 scan\r\n\r\n*Ground Rules:*\r\n* All ideas are welcome.\r\n* No shooting down concepts\u2014only building on them.\r\n* Humor encouraged; feasibility optional.\r\n* The wilder, the better.\r\n\r\n*Who Should Attend:*\r\nAnyone who uses Wireshark, contributes to it, builds tooling around it, or likes thinking sideways. No technical depth required\u2014just curiosity and a willingness to have fun.", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/FYWGV9/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/FYWGV9/", "attachments": []}]}}, {"index": 2, "date": "2026-07-19", "day_start": "2026-07-19T04:00:00-05:00", "day_end": "2026-07-20T03:59:00-05:00", "rooms": {"Hermitage ABC | General Session": [{"guid": "987f7bf9-4da2-56f6-b74c-10bd081e2627", "code": "BSA8P7", "id": 189, "logo": null, "date": "2026-07-19T09:00:00-05:00", "start": "09:00", "duration": "08:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-189-1-pre-conference-class-i-practical-wireshark-skills-for-it-professionals", "url": "https://conference.wireshark.org/sf26us/talk/BSA8P7/", "title": "Pre-Conference Class I: Practical Wireshark Skills for IT professionals", "subtitle": "", "track": "Pre-conference class", "type": "Pre Conference Class", "language": "en", "abstract": "**Hands on Wireshark Lab and Wireshark Certified Analyst Prep**\r\n\r\nPractical Wireshark Troubleshooting is a two-day, hands-on course designed to strengthen your packet analysis and troubleshooting skills. On Day 1, Ross Bagurdes guides you through Wireshark\u2019s key features, capture methods, filtering techniques, and foundational protocols at the Data Link and Network layers. On Day 2, Chris Greer takes you deeper into Transport and Application layer analysis, focusing on TCP, UDP, and the tools that uncover real-world performance problems. By the end, you\u2019ll know how to approach network issues with confidence \u2014 and be better prepared for the Wireshark Certified Analyst exam.", "description": "Level up your Wireshark skills and get ready for Sharkfest! This hands-on course will provide core Wireshark skills for IT pros of all experience levels. Participants will gain a solid understanding of how to use Wireshark to capture, analyze, and troubleshoot network traffic. The course is designed with beginners in mind, but even seasoned packet people will pick up new tips and tricks.", "recording_license": "", "do_not_record": true, "persons": [{"code": "PXMJ8G", "name": "Chris Greer", "avatar": "https://conference.wireshark.org/media/avatars/Chris_New_mug_K5fG1wf.png", "biography": "Like you, Chris likes digging into packet captures to figure out how things work. When he is not teaching people the art of packet analysis in live courses, YouTube videos, or at conference seminars, you can find him in the packet trenches with clients from all over the world. Chris has been attending and speaking at Sharkfest since 2011 and enjoys learning new things right alongside attendees of all experience levels.", "public_name": "Chris Greer", "guid": "0c68084e-3d29-5ef1-8b33-42e9bdef9f99", "url": "https://conference.wireshark.org/sf26us/speaker/PXMJ8G/"}, {"code": "NNQ7UM", "name": "Ross Bagurdes", "avatar": null, "biography": "Ross has had a diverse career in engineering, beginning as a structural engineer, then project engineer for a gas utility, Ross was always quickly\r\nassigned the de-facto network administrator, typically after no one else was brave enough to break, and later fix, the network. This lead to working as a network engineer designing and implementing enterprise networks for a major university hospital. Here he worked with\r\nExtreme Networks, HP, Cisco, Tipping Point, among other network technology, as well as honed his Wireshark and protocol analysis skills. Ross\r\nspent 7 years teaching data networking at Madison College, and in 2017 started authoring and producing IT training videos in Wireshark/Protocol\r\nAnalysis, Cisco, and general networking topics for www.Pluralsight.com. In his free time, you'll find Ross and his dog at the beach swimming and\r\nsurfing, traveling, hiking, or snowboarding somewhere in the western US.", "public_name": "Ross Bagurdes", "guid": "3935f6fc-0f65-5cda-b7bb-b235f5b36c5f", "url": "https://conference.wireshark.org/sf26us/speaker/NNQ7UM/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/BSA8P7/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/BSA8P7/", "attachments": []}]}}, {"index": 3, "date": "2026-07-20", "day_start": "2026-07-20T04:00:00-05:00", "day_end": "2026-07-21T03:59:00-05:00", "rooms": {"Hermitage ABC | General Session": [{"guid": "902e8e03-54cc-5233-a277-e18dee25ec41", "code": "A3PJVZ", "id": 190, "logo": null, "date": "2026-07-20T09:00:00-05:00", "start": "09:00", "duration": "08:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-190-pre-conference-class-ii-introduction-to-stratoshark-for-network-engineers", "url": "https://conference.wireshark.org/sf26us/talk/A3PJVZ/", "title": "Pre-Conference Class II: Introduction to Stratoshark for Network Engineers", "subtitle": "", "track": "Pre-conference class", "type": "Pre Conference Class", "language": "en", "abstract": "Stratoshark brings Wireshark-style visibility to the Linux system, letting you see what's happening inside the OS alongside the network traffic it generates. In this hands-on workshop, you'll learn to use sysdig and Stratoshark to trace system calls, correlate them with packet data, and answer questions that packets alone can't \u2014 like which process handled a connection or how a service behaved under load. Designed for network engineers ready to go one level deeper, the session blends short lectures with guided exercises using cloud-based lab systems. You'll leave with a working understanding of Stratoshark and the confidence to begin using it in your own analysis.", "description": "", "recording_license": "", "do_not_record": true, "persons": [{"code": "LJMB8P", "name": "Josh Clark", "avatar": "https://conference.wireshark.org/media/avatars/a6cf3a193a4d11c2267b2c91698d3492_ikPSVyM.jpg", "biography": "Josh has both academic and real-world experience in the world of protocol analysis. He holds an M.S. degree in Computer Engineering with a focus in network engineering and has spent the past 8 years designing, troubleshooting, and optimizing networks and applications. He is a Wireshark Certified Analyst.", "public_name": "Josh Clark", "guid": "29a8c981-dca2-5ee5-aa17-869b6103ca3b", "url": "https://conference.wireshark.org/sf26us/speaker/LJMB8P/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/A3PJVZ/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/A3PJVZ/", "attachments": []}, {"guid": "10a85ba4-b4fd-5a0e-8d82-22122a8f89f7", "code": "PGTGW3", "id": 241, "logo": null, "date": "2026-07-20T17:00:00-05:00", "start": "17:00", "duration": "00:30", "room": "Hermitage ABC | General Session", "slug": "sf26us-241-sharkfest-how-to-tutorial", "url": "https://conference.wireshark.org/sf26us/talk/PGTGW3/", "title": "Sharkfest How To Tutorial", "subtitle": "", "track": "Beginner", "type": "Presentation", "language": "en", "abstract": "Are you at Sharkfest for the first time? Then this session is for you. We'll explain how the conference works and what's probably different from other conference you may have been at. You'll learn about Packet Doctors, the evening events, the onsite WCA exam, and what the developer den is. The goal is to make sure you don't feel you missed out on something at the end of the conference because you didn't know how it worked.", "description": "This should be a **30 minute slot** right before the welcome dinner, if possible, or maybe parallel to the start of the welcome dinner.", "recording_license": "", "do_not_record": false, "persons": [{"code": "8HYSYC", "name": "Jasper Bongertz", "avatar": "https://conference.wireshark.org/media/avatars/JJLHFE_AA3w1ru.webp", "biography": "Jasper is the Head of the Computer Security Incident Response Team (CSIRT) at G Data CyberDefense in Bochum, Germany. In that role he is running a team of computer/network/memory forensics experts as well as a couple of malware reverse engineers and a number of Incident Handlers. The CSIRT helps customers that have been compromised (A.K.A. \"hacked\"), mostly with the attacker's intent of preparing/performing a ransomware extortion.\r\n\r\nJasper's official role at the G Data CSIRT is \"Principal Network Security Specialist\". He has over 20 years of experience in computer network analysis and network forensics, and has forgotten more about network protocols than most people will ever learn (Token Ring, ATM, some serial stuff). In previous employments he wrote and taught a number of Ethereal & Wireshark 3-5 day classes as well as official VMware classes, and Hacking courses. \r\n\r\nJasper is a Wireshark Certified Analyst (WCA #2) and member of the board of directors of the Wireshark Foundation.", "public_name": "Jasper Bongertz", "guid": "01090920-dcf6-5bfc-8ce9-c09dfc5e857c", "url": "https://conference.wireshark.org/sf26us/speaker/8HYSYC/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/PGTGW3/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/PGTGW3/", "attachments": []}, {"guid": "8cb11da3-b08e-5883-b105-779c7b2e0846", "code": "X73HTY", "id": 186, "logo": null, "date": "2026-07-20T17:30:00-05:00", "start": "17:30", "duration": "03:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-186-sharkfest-26-us-welcome-dinner-sponsor-showcase", "url": "https://conference.wireshark.org/sf26us/talk/X73HTY/", "title": "SharkFest'26 US Welcome Dinner & Sponsor Showcase", "subtitle": "", "track": "Organization", "type": "Dinner", "language": "en", "abstract": "Let's kick-off the conference in style!", "description": "SharkFest'26 US Welcome Dinner & Sponsor Showcase", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/X73HTY/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/X73HTY/", "attachments": []}]}}, {"index": 4, "date": "2026-07-21", "day_start": "2026-07-21T04:00:00-05:00", "day_end": "2026-07-22T03:59:00-05:00", "rooms": {"Hermitage ABC | General Session": [{"guid": "cd3b8e9e-70c9-5f81-94f0-d16f227fc097", "code": "H89ETP", "id": 191, "logo": null, "date": "2026-07-21T09:00:00-05:00", "start": "09:00", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-191-keynote-wireshark-progress-problems-and-plans", "url": "https://conference.wireshark.org/sf26us/talk/H89ETP/", "title": "Keynote: Wireshark Progress, Problems, and Plans", "subtitle": "", "track": "Organization", "type": "Organization", "language": "en", "abstract": "Gerald Combs & Friends talk about the new developments over the past year", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "T8PUVR", "name": "Gerald Combs", "avatar": null, "biography": null, "public_name": "Gerald Combs", "guid": "e80ddc9a-7193-5265-8936-399d1dbe61a3", "url": "https://conference.wireshark.org/sf26us/speaker/T8PUVR/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/H89ETP/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/H89ETP/", "attachments": []}, {"guid": "78ff160d-9c2c-575b-a9a4-cdda13638429", "code": "GKG8F3", "id": 237, "logo": null, "date": "2026-07-21T10:15:00-05:00", "start": "10:15", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-237-what-is-new-in-wireshark", "url": "https://conference.wireshark.org/sf26us/talk/GKG8F3/", "title": "What is new in Wireshark", "subtitle": "", "track": "Beginner", "type": "Presentation", "language": "en", "abstract": "We give an overview over interesting tidbits with the Wireshark Development team as well as an outlook on version 5.0", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "CUN9HX", "name": "Roland Knall", "avatar": null, "biography": null, "public_name": "Roland Knall", "guid": "325b830f-f2bc-5d6d-bbe1-780ae3a3c1bd", "url": "https://conference.wireshark.org/sf26us/speaker/CUN9HX/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/GKG8F3/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/GKG8F3/", "attachments": []}, {"guid": "eef77d22-8009-529f-892e-3992b513156a", "code": "DBPZAJ", "id": 207, "logo": null, "date": "2026-07-21T11:30:00-05:00", "start": "11:30", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-207-demystifying-dns-security-dnssec-dot-doh-doq-when-and-where-to-use-them", "url": "https://conference.wireshark.org/sf26us/talk/DBPZAJ/", "title": "Demystifying DNS Security: DNSSEC, DoT, DoH, DoQ - When and Where to Use them", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "DNS security doesn\u2019t have to be confusing! In this session, we\u2019ll break down DNSSEC, DoT, DoH, and DoQ in simple terms\u2014what they do, how they\u2019re different, and why you need to know when and where to use each one. We\u2019ll take a hands-on look with Wireshark to see how these protocols actually behave at the packet level. By the end, you'll have a solid grasp of how to secure your DNS traffic, what Protective DNS really does, and how to pick the right tool for the job.\r\n\r\nBeginners welcome. DNS newbies too.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "PXMJ8G", "name": "Chris Greer", "avatar": "https://conference.wireshark.org/media/avatars/Chris_New_mug_K5fG1wf.png", "biography": "Like you, Chris likes digging into packet captures to figure out how things work. When he is not teaching people the art of packet analysis in live courses, YouTube videos, or at conference seminars, you can find him in the packet trenches with clients from all over the world. Chris has been attending and speaking at Sharkfest since 2011 and enjoys learning new things right alongside attendees of all experience levels.", "public_name": "Chris Greer", "guid": "0c68084e-3d29-5ef1-8b33-42e9bdef9f99", "url": "https://conference.wireshark.org/sf26us/speaker/PXMJ8G/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/DBPZAJ/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/DBPZAJ/", "attachments": []}, {"guid": "80ecd092-3c9d-5377-b2db-c105f5effbdf", "code": "SAY8D9", "id": 166, "logo": null, "date": "2026-07-21T13:30:00-05:00", "start": "13:30", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-166-lost-in-transmission", "url": "https://conference.wireshark.org/sf26us/talk/SAY8D9/", "title": "Lost In Transmission", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "Finding and counting packet losts in each layer", "description": "Packets lost occur in many situations, showing the shape in various layers.\r\nDifferences in the number of packets between the passive start tap. (layer1,2)\r\nThe same IPID and a different offset as disappearance in the packet buffer in the router processing\r\nRetransmission of TCP segments as a result of a traffic jam.\r\nUDP application works with packet loss.\r\n\r\nIn this session, you can learn the major case of packet loss and you can find the way to find and count packet loss and retransmissions. Megumi shares the best way to understand invisible packet losses with Wireshark!", "recording_license": "", "do_not_record": false, "persons": [{"code": "MQPULF", "name": "Megumi Takeshita", "avatar": "https://conference.wireshark.org/media/avatars/ea73b656018238499cd621f442bec89d_hPlCb4o.jpg", "biography": "Megumi Takeshita, packet otaku, runs a packet company, ikeriri network service in Japan. Ikeriri offers services such as packet analysis for troubleshooting, debugging, security inspection. Ikeriri is also a reseller of wired/wireless capture and analysis products. Megumi has authored 10+ books about Wireshark and packet analysis. She also instructs Wireshark for Japanese companies, including the Japan Self-Defence Forces and Chuo University, as a lecturer. She is one of contributors to the Wireshark projects including Japanese localization.", "public_name": "Megumi Takeshita", "guid": "21f525f3-2a01-5598-b519-0228df74f377", "url": "https://conference.wireshark.org/sf26us/speaker/MQPULF/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/SAY8D9/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/SAY8D9/", "attachments": []}, {"guid": "fa62fd63-e2a1-5f58-a5b2-4ace8e77a8f6", "code": "XPYXAB", "id": 196, "logo": null, "date": "2026-07-21T14:45:00-05:00", "start": "14:45", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-196-wireshark-the-prequel-what-to-do-before-you-look-at-a-capture", "url": "https://conference.wireshark.org/sf26us/talk/XPYXAB/", "title": "Wireshark: The Prequel - What to do BEFORE you look at a capture", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "\"Something is wrong with the network. I used to get 4Gbps transfers but now I'm only getting 120Mbps. Did you change something recently?\"\r\n\r\nSound familiar? If you've spent any time supporting production systems, you've probably heard some variation of this complaint. Before jumping to conclusions about where the problem lies, we need to understand what's actually happening at the TCP layer on both endpoints.", "description": "This presentation is inspired by a series of articles I wrote on LinkedIn focused on practical, real world troubleshooting of application network performance issues.  Instead of deep diving in to packet captures, this presentation will highlight the various tools and metrics available on Linux systems that help engineers and administrators pinpoint the true source(s) of application performance problems when \"the network\" is blamed.  \r\n\r\nWe will focus on how packets are processed in a Linux system from the NIC, through the OS, up to the application.  We will then take a closer look at TCP itself, utilizing native Linux tooling to introspect on individual TCP socket performance.  This TCP socket introspection will dive in to each socket's calculated network latency (RTT), packet sizing (MTU and MSS), and packet loss (retransmissions, SACK, duplicate ACKs", "recording_license": "", "do_not_record": false, "persons": [{"code": "MQCSJF", "name": "Rob MacDonald", "avatar": "https://conference.wireshark.org/media/avatars/MQCSJF_WFVLgfI.jpg", "biography": "Principal Network Engineer | Low-Latency Infrastructure | Global Datacenter Architecture\r\n\r\nWith extensive experience in network architecture and infrastructure, I currently serve as a Principal Consultant at Kyberis Networks. My work focuses on leveraging expertise in Networks, Systems, and Security to address complex challenges and deliver innovative technical solutions tailored to organizational needs. \r\n\r\nPreviously, I contributed to high-speed, low-latency network design and operations at a financial trading company, where I applied advanced knowledge of IP network architectures and datacenter technologies. My passion lies in enabling secure, scalable, and efficient systems that support mission-critical business objectives.", "public_name": "Rob MacDonald", "guid": "7e6b2c3c-cc25-506b-92bd-40d9a5d3648f", "url": "https://conference.wireshark.org/sf26us/speaker/MQCSJF/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/XPYXAB/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/XPYXAB/", "attachments": []}, {"guid": "4ceb7c5d-7c53-54f2-be1a-4b5ccaaf5d12", "code": "PNSKEA", "id": 232, "logo": null, "date": "2026-07-21T16:00:00-05:00", "start": "16:00", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-232-capturing-the-spectrum-of-wireless-packets", "url": "https://conference.wireshark.org/sf26us/talk/PNSKEA/", "title": "Capturing the spectrum of wireless packets", "subtitle": "", "track": "Beginner", "type": "Presentation", "language": "en", "abstract": "There is a veritable avalanche of wireless devices, from Wi-Fi and Bluetooth to Zigbee, aircraft, thermometers, door sensors, Lora mesh, and more.  If you can't see it, you can't analyze it or debug it; we'll talk about ways to capture as many protocols flying around in the air as we can, and what the most affordable hardware to do it is.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "3BJBBY", "name": "Mike Kershaw", "avatar": null, "biography": "Mike is the author of Kismet, an open-source Wi-Fi and general radio sniffer and IDS tool, and works for Hak5 developing the WiFi Pineapple and other security related tools.", "public_name": "Mike Kershaw", "guid": "133da8ac-a2ab-5acd-a959-18ee0f92d15d", "url": "https://conference.wireshark.org/sf26us/speaker/3BJBBY/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/PNSKEA/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/PNSKEA/", "attachments": []}, {"guid": "2e6a4435-1f25-5e6f-91a7-329d982f6ac4", "code": "LRBBM8", "id": 199, "logo": "https://conference.wireshark.org/media/sf26us/submissions/LRBBM8/Packets_in_the_Power_Grid_Lopez_Session_Image_tfk_TO2yCQv.webp", "date": "2026-07-21T17:15:00-05:00", "start": "17:15", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-199-packets-in-the-power-grid-a-journey-inside-the-substation", "url": "https://conference.wireshark.org/sf26us/talk/LRBBM8/", "title": "Packets in the Power Grid: A Journey Inside the Substation", "subtitle": "", "track": "Beginner", "type": "Presentation", "language": "en", "abstract": "Ever wondered what really happens inside a power substation during everyday operations? In this session, we\u2019ll take a dynamic \u201cflyover\u201d of a small-to-medium-sized substation, exploring critical points where power and data intersect and uncovering the interactions that keep the power system stable and responsive.\r\n\r\nWe\u2019ll look at how these elements work together to keep the lights on\u2014and how their digital nervous system communicates in real time. \r\n\r\nTo bring it all together, we\u2019ll walk through a real-world power system event, following the flow of communication from the initial fault detection all the way to the control center\u2019s response and back to the field. Along the way, we\u2019ll decode how these messages orchestrate recovery and maintain reliability. Whether you\u2019re a packet sleuth or a power systems enthusiast, this session gives you a front-row seat to the intersection of operational technology and network analysis.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "GVFMCK", "name": "Daniel Lopez", "avatar": "https://conference.wireshark.org/media/avatars/SEL_Profile_Picture_Bn5XRpX.jpg", "biography": "Daniel Lopez is a dedicated professional currently serving as a Lead Integration & Automation Engineer at Schweitzer Engineering Laboratories. In this role, Daniel works in the R&D forensics group, where they analyze field failures to determine root cause and provide recommendations to customers.\r\n\r\nDaniel graduated from LeTourneau University in 2020 with a bachelor's degree in Electrical Engineering. During his time in the forensics group, he discovered Wireshark and quickly became captivated by its capabilities. This newfound interest led him to pursue the WCNA certification, further enhancing his expertise in network analysis.", "public_name": "Daniel Lopez", "guid": "29dfb55b-001c-5a53-8f60-439d815c1e69", "url": "https://conference.wireshark.org/sf26us/speaker/GVFMCK/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/LRBBM8/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/LRBBM8/", "attachments": []}, {"guid": "e65ddf83-bd86-5982-b329-45566f710965", "code": "WNWRRU", "id": 187, "logo": null, "date": "2026-07-21T18:30:00-05:00", "start": "18:30", "duration": "03:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-187-sponsor-technology-showcase-reception-team-trivia-for-it-nerds-and-dinner", "url": "https://conference.wireshark.org/sf26us/talk/WNWRRU/", "title": "Sponsor Technology Showcase Reception, Team Trivia for IT Nerds, and Dinner", "subtitle": "", "track": "Organization", "type": "Dinner", "language": "en", "abstract": "Sponsor Showcase and dinner", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/WNWRRU/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/WNWRRU/", "attachments": []}], "Hermitage D | Classroom": [{"guid": "5e865f1a-9c33-5d02-8f77-f3879003ec37", "code": "ZBAFXP", "id": 240, "logo": null, "date": "2026-07-21T11:30:00-05:00", "start": "11:30", "duration": "01:00", "room": "Hermitage D | Classroom", "slug": "sf26us-240-tcp-details-that-matter-for-the-wca-exam", "url": "https://conference.wireshark.org/sf26us/talk/ZBAFXP/", "title": "TCP details that matter for the WCA Exam", "subtitle": "", "track": "Expert / Developer", "type": "Presentation", "language": "en", "abstract": "The _Wireshark Certified Analyst_ exam is not an easy certification to take, especially if your knowledge about the details of the TCP protocol is somewhat shaky. In this talk we'll take a look at the aspects mentioned in the WCA curriculum and discuss them together. The goal is to make sure you understand what you need to bring to the exam and help you identify the areas where you might have to improve your skill analyzing TCP to achieve the WCA status.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "8HYSYC", "name": "Jasper Bongertz", "avatar": "https://conference.wireshark.org/media/avatars/JJLHFE_AA3w1ru.webp", "biography": "Jasper is the Head of the Computer Security Incident Response Team (CSIRT) at G Data CyberDefense in Bochum, Germany. In that role he is running a team of computer/network/memory forensics experts as well as a couple of malware reverse engineers and a number of Incident Handlers. The CSIRT helps customers that have been compromised (A.K.A. \"hacked\"), mostly with the attacker's intent of preparing/performing a ransomware extortion.\r\n\r\nJasper's official role at the G Data CSIRT is \"Principal Network Security Specialist\". He has over 20 years of experience in computer network analysis and network forensics, and has forgotten more about network protocols than most people will ever learn (Token Ring, ATM, some serial stuff). In previous employments he wrote and taught a number of Ethereal & Wireshark 3-5 day classes as well as official VMware classes, and Hacking courses. \r\n\r\nJasper is a Wireshark Certified Analyst (WCA #2) and member of the board of directors of the Wireshark Foundation.", "public_name": "Jasper Bongertz", "guid": "01090920-dcf6-5bfc-8ce9-c09dfc5e857c", "url": "https://conference.wireshark.org/sf26us/speaker/8HYSYC/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/ZBAFXP/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/ZBAFXP/", "attachments": []}, {"guid": "b1f84748-76a6-5759-929d-44dd659a0b44", "code": "PDJYJ9", "id": 201, "logo": null, "date": "2026-07-21T13:30:00-05:00", "start": "13:30", "duration": "01:00", "room": "Hermitage D | Classroom", "slug": "sf26us-201-mac-privacy-protocol-wireshark-plugin", "url": "https://conference.wireshark.org/sf26us/talk/PDJYJ9/", "title": "MAC Privacy Protocol Wireshark Plugin", "subtitle": "", "track": "Expert / Developer", "type": "Presentation", "language": "en", "abstract": "Engineers at Pacific Northwest National Laboratory (PNNL) have been working to add support for MAC Privacy Protection protocol (IEEE 802.1AEdk) to the Linux kernel. MAC Privacy is a Layer 2 protocol intended primarily for use with MAC Security (IEEE 802.1AE) which can modify network traffic metadata including source and destination addresses, timing, and volume. Engineers decided early that having the ability to dissect this new network protocol in Wireshark would not only aid development and testing but also eventually be expected by the community. In this talk, engineers at PNNL present a new Wireshark dissector plugin for handling MAC Privacy protocol. They cover the plugin and its features as well as the pros and cons of developing a Wireshark plugin in Rust.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "7G8USQ", "name": "Cameron Smith", "avatar": null, "biography": "Cameron Smith is a cyber security engineer at Pacific Northwest National Laboratory (PNNL) with a focus on developing secure and robust software solutions.", "public_name": "Cameron Smith", "guid": "d84b2c28-2597-577e-923f-f3903690d0ae", "url": "https://conference.wireshark.org/sf26us/speaker/7G8USQ/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/PDJYJ9/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/PDJYJ9/", "attachments": []}, {"guid": "da5c8e63-eda7-54aa-95de-6eb10f16cb2e", "code": "CPNTMA", "id": 249, "logo": "https://conference.wireshark.org/media/sf26us/submissions/CPNTMA/image_Sut1jmD.webp", "date": "2026-07-21T14:45:00-05:00", "start": "14:45", "duration": "01:00", "room": "Hermitage D | Classroom", "slug": "sf26us-249-ngne-with-ai-think-like-an-architect", "url": "https://conference.wireshark.org/sf26us/talk/CPNTMA/", "title": "NGNE with AI: Think Like an Architect", "subtitle": "", "track": "A.I.", "type": "Presentation", "language": "en", "abstract": "AI is already changing how network engineers learn, troubleshoot, document, automate, and operate networks. But the opportunity is not to hand the network over to a chatbot. The opportunity is for hands-on practitioners to move up a level: defining better workflows, writing clearer requirements, setting stronger guardrails, validating results, and using AI as a force multiplier.\r\n\r\nThis talk introduces practical AI concepts for network engineers, including LLMs, agents, prompt workflows, API-based tooling, Spec-Driven Development, Test-Driven Development, and the role of deterministic automation alongside AI systems. We will walk through realistic NetOps use cases such as MOP review, incident summarization, log and packet capture analysis, Python and config generation, and an SDD-based workflow using real AI-assisted infrastructure design work.\r\n\r\nThe central message is simple: the next-generation network engineer does not stop being hands-on. The NGNE learns to think like an architect.", "description": "Here is a slightly longer version of the abstract:\r\n\r\nAI is already changing how network engineers learn, troubleshoot, document, automate, and operate networks. But the opportunity is not to hand the network over to a chatbot. The opportunity is for hands-on practitioners to move up a level: defining better workflows, writing clearer requirements, setting stronger guardrails, validating results, and using AI as a force multiplier.\r\n\r\nThis talk introduces practical AI concepts for network engineers, including LLMs, agents, prompt workflows, API-based tooling, Spec-Driven Development, Test-Driven Development, and the role of deterministic automation alongside AI systems. We will walk through realistic NetOps use cases such as MOP review, incident summarization, documentation cleanup, log and packet capture analysis, Python generation, config generation, and an SDD-based workflow using real AI-assisted infrastructure design work.\r\n\r\nThe central message is simple: the next-generation network engineer does not stop being hands-on. The NGNE learns to think like an architect: designing workflows, constraining tools, reviewing ruthlessly, validating behavior, and using the right tool for the right job.", "recording_license": "", "do_not_record": false, "persons": [{"code": "FJWTLQ", "name": "Scott F Robohn", "avatar": "https://conference.wireshark.org/media/avatars/RM7RKS_cPrO4S8.webp", "biography": "Scott Robohn is co-founder and CEO of Solutional, where he leads consulting, training, and technical marketing in next-gen networking, automation, and AI. With 35+ years of experience building, guiding, and scaling technical teams and solutions, Scott helps IT organizations evolve into software-centric, resilient, and intelligent network operations teams. Scott is a frequent event speaker, a co-founder of the Network Automation Forum (NAF), host of the Total Network Operations podcast, and a leader of the (VA)NUG chapter of USNUA.", "public_name": "Scott F Robohn", "guid": "331b84dc-3354-5fc3-baa8-e7122dd450a3", "url": "https://conference.wireshark.org/sf26us/speaker/FJWTLQ/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/CPNTMA/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/CPNTMA/", "attachments": []}, {"guid": "a9fdf509-af7f-5449-ab64-4c230c8dc7c9", "code": "BGPWJC", "id": 231, "logo": null, "date": "2026-07-21T16:00:00-05:00", "start": "16:00", "duration": "02:15", "room": "Hermitage D | Classroom", "slug": "sf26us-231-wireshark-plus-advanced-analytics-better-together-2-part-session", "url": "https://conference.wireshark.org/sf26us/talk/BGPWJC/", "title": "Wireshark plus Advanced Analytics \u2013 Better Together (2 part session)", "subtitle": "", "track": "Expert / Developer", "type": "Workshop", "language": "en", "abstract": "Real life troubleshooting a difficult 3rd party software performance issue with using Wireshark and Advanced Analytics", "description": "Join us for a troubleshooting deep dive into solving a difficult problem occurring within Webex login from 2018, known as the 98% hang condition.  We\u2019ll showcase how the partnership of Wireshark and Advanced Analytics can be leveraged to quickly isolate the fault domain.  Captures will be provided for use during the session.  Session is half presentation and half hands-on lab with Wireshark.", "recording_license": "", "do_not_record": false, "persons": [{"code": "QQVD3Z", "name": "John Pittle", "avatar": null, "biography": "As a Performance Management Strategist, John helps his customers develop and execute strategies for integrating Performance Management as an IT discipline across the organization. He has been actively focused on Performance Engineering and Analysis for networks, systems, and applications since the early 90s; performance troubleshooting is his passion and joy. His packet analysis toolbox includes Wireshark (of course), as well as NetShark, AppResponse, Packet Analyzer, and Transaction Analyzer.", "public_name": "John Pittle", "guid": "a0c62c9e-a48b-504e-be3e-c6b14d4764c8", "url": "https://conference.wireshark.org/sf26us/speaker/QQVD3Z/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/BGPWJC/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/BGPWJC/", "attachments": []}]}}, {"index": 5, "date": "2026-07-22", "day_start": "2026-07-22T04:00:00-05:00", "day_end": "2026-07-23T03:59:00-05:00", "rooms": {"Hermitage ABC | General Session": [{"guid": "a1446d4c-04f3-5f74-8978-604033793d19", "code": "3BTBPN", "id": 200, "logo": null, "date": "2026-07-22T09:00:00-05:00", "start": "09:00", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-200-keynote-packets-through-the-ages-a-personal-story", "url": "https://conference.wireshark.org/sf26us/talk/3BTBPN/", "title": "Keynote: Packets through the ages \u2013 A personal story", "subtitle": "", "track": "Beginner", "type": "Presentation", "language": "en", "abstract": "Before the rise of the internet (mid 1980s through the mid 1990\u2019s , the packet and protocol ecosystem was much different than it was today. Many of the protocols have now gone extinct and new ones have risen in their place.\r\n\r\nMoving from the world of serial protocols (e.g. HDLC/SDLC) to the Internet stack was a seismic shift, but the need to understand what\u2019s on the wire only became more important.\r\n\r\nWhat the transition was like, and why Wireshark was crucial in enabling it.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "3ULMPF", "name": "Peter Jones", "avatar": null, "biography": "Peter is a Distinguished Engineer in Cisco\u2019s Networking Hardware team, chairs the Ethernet Alliance, and is active in IEEE 802.3 lower speed (<100Gb/) projects.\r\n\r\nPeter works on system architecture and wired standards across Cisco\u2019s networking portfolio and was deeply involved in development of the Catalyst 9000 switches and the UADP family of ASICs.\r\n\r\nPeter started in networking in the mid-1980s before PCs took over, when RS232 was the media of choice and 64Kb/s was super-fast. Peter is passionate about Network Evolution, Adoptable Technology and Mentoring.", "public_name": "Peter Jones", "guid": "67704b09-86d2-5cd2-8d49-cc09f8918c5f", "url": "https://conference.wireshark.org/sf26us/speaker/3ULMPF/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/3BTBPN/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/3BTBPN/", "attachments": []}, {"guid": "6fbb9f1a-de99-5332-b32b-b5626887d8f3", "code": "ZSVEAS", "id": 234, "logo": "https://conference.wireshark.org/media/sf26us/submissions/ZSVEAS/image_TrEMmid.webp", "date": "2026-07-22T10:15:00-05:00", "start": "10:15", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-234-burnout-is-only-the-beginning-how-to-prevent-a-buildup-of-trauma-in-it", "url": "https://conference.wireshark.org/sf26us/talk/ZSVEAS/", "title": "Burnout Is Only the Beginning: How to Prevent a Buildup of Trauma in IT", "subtitle": "", "track": "Beginner", "type": "Presentation", "language": "en", "abstract": "Your network never sleeps. Neither does your team \u2014 and that's the problem.\r\n\r\nIT pros are on call at 3am, absorbing abuse from non-technical staff, and carrying the weight of every outage. The result? A workforce burning out quietly, abandoning their posts, snapping at their families, and turning to substances to cope. According to the CDC, suicide rates among IT professionals are quietly climbing. This discussion needs to happen now.\r\n\r\nDJ Eshelman has 25+ years in IT consulting and has lived these stories firsthand. In this session, he breaks down how trauma accumulates in IT, why burnout is a management failure not a technology one, and what network leaders can do right now to stop the cycle.\r\n\r\nYou'll leave with: practical steps to protect your team, reduce technical debt, and retain the people keeping your infrastructure alive.\r\n\r\nThe biggest threat to your network isn't the next zero-day or patch gone bad. It's losing the people who defend it.", "description": "**Why Your Network Is Only As Strong As The People Running It**\r\n\r\nYou came to SharkFest to sharpen your technical skills. But this is the session that might change something more fundamental.\r\n\r\nNetwork engineers are among the most overworked, under-resourced professionals in any industry. The 3am calls, the constant firefighting, the impossible on-call expectations \u2014 they don't just create stress. Over time, they create trauma. And that trauma follows people from job to job, quietly compounding until it becomes a crisis.\r\n\r\nDJ Eshelman has 25+ years in IT  consulting and has lived these stories firsthand. Now as an Independent Executive Director with Maxwell Leadership, he's dedicated to changing the IT Leadership world.\r\nIn this session, he breaks down how trauma accumulates in technical environments, how to recognize the signs in yourself and your team, and critically, why most of it is a management problem, not a technology problem.\r\n\r\nYou'll leave with:\r\n\r\n- A clear framework for understanding the IT trauma cycle (aka IT PTSD)\r\n- Practical steps managers can take immediately to protect their teams\r\n- Tools for structured priority management that reduce reactive chaos\r\n- An honest look at what actually retains great technical talent\r\n\r\nPrior attendees have had all-day discussions about this talk which tells us it is just that important right now.\r\n\r\nWhether you're an individual contributor, a team lead, or a department head, the health of the people running your network is just as mission-critical as the network itself.\r\n\r\nThe biggest threat to your infrastructure isn't the next zero-day. It's losing the people who defend it.", "recording_license": "", "do_not_record": false, "persons": [{"code": "YFPEJU", "name": "D. J. Eshelman", "avatar": "https://conference.wireshark.org/media/avatars/7NLBNH_wPFrSfp.webp", "biography": "D.J. Eshelman started working in IT Services in 1997.\r\nHe's traveled the world as a leading Consultant for companies like Citrix, where he served as an Independent Resident Consulting Architect from 2011 to 2023, serving dozens of Top 100 companies.\r\nHe is the author of \"Just Do THIS: A Simpler Way to Succeed in I.T.\" as well as \"Be a Citrix Hero\"\r\nHe's the founder of the Thrive-IT and Citrix Hero YouTube/Podcasts.\r\nHe is a Coach, Speaker, Trainer/Facilitator, and DISC Consultant as an Independent Executive Director with Maxwell Leadership - John C Maxwell's team of over 60,000 certified coaches.\r\nBased out of Nashville, TN - he is working on an epic novel about the life (and traumas) faced by a Network Engineer in a Healthcare company who's been Voluentold to take on leadership. In the meantime, he speaks to audiences worldwide about how to be better not just in technology, but in life!", "public_name": "D. J. Eshelman", "guid": "502e91ba-af5a-568b-8248-9760029deb21", "url": "https://conference.wireshark.org/sf26us/speaker/YFPEJU/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/ZSVEAS/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/ZSVEAS/", "attachments": []}, {"guid": "4ee6041d-435a-557a-b00a-ca53b248761c", "code": "VAHVRB", "id": 195, "logo": null, "date": "2026-07-22T11:30:00-05:00", "start": "11:30", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-195-media-casting-protocols-everything-airplay-airdrop-and-wi-fi-aware", "url": "https://conference.wireshark.org/sf26us/talk/VAHVRB/", "title": "Media Casting Protocols: Everything AirPlay, AirDrop and Wi-Fi Aware", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "Ever have a client fail to find an Apple TV? Or have slow or stuttering streaming? \r\n\r\nWell, then look no more! AirPlay and other casting protocols are surprisingly complex, but with the help of packets, you can feel more confident troubleshooting.", "description": "We will walk through: \r\n\r\n-AirPlay vs AirDrop\r\n-The five phases of AirPlay \r\n-How to troubleshoot the phases over packet capture (802.11, BLE) and MacBook console\r\n-The changes to AirPlay above iOS 26 and Android support\r\n-Alternatives to AirPlay such as Wi-Fi Aware and Miracast, differences over in packet captures", "recording_license": "", "do_not_record": false, "persons": [{"code": "AGSWSA", "name": "Eva Santos", "avatar": "https://conference.wireshark.org/media/avatars/Eva_Santos_Headshot_QGQZ1NO_pAGK2hE.jpg", "biography": "Eva Santos is a Support Engineer at Meter, specialising in enterprise Wi-Fi troubleshooting. Her roles have varied from wireless design/consulting to product support. She\u2019s passionate about demystifying Wi-Fi through social media. Outside of the support desk, she's a presenter at events like WLPC and has written guest blogs for CWNP and Informa TechTarget.", "public_name": "Eva Santos", "guid": "98e8f7b9-2736-586a-8b71-f982b3523452", "url": "https://conference.wireshark.org/sf26us/speaker/AGSWSA/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/VAHVRB/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/VAHVRB/", "attachments": []}, {"guid": "fd838313-22d1-53a8-9621-178998ba0af4", "code": "A7BFDV", "id": 194, "logo": null, "date": "2026-07-22T13:30:00-05:00", "start": "13:30", "duration": "01:30", "room": "Hermitage ABC | General Session", "slug": "sf26us-194-the-packet-doctors-are-in-packet-trace-examinations-with-the-experts", "url": "https://conference.wireshark.org/sf26us/talk/A7BFDV/", "title": "The Packet Doctors are in! Packet trace examinations with the experts", "subtitle": "", "track": null, "type": "Packetdoctors Session", "language": "en", "abstract": "The experts on this panel have been asked to look at a trace file and help find a reason for certain behaviors by attendees at many SharkFests. Based on this, they\u2019ve decided to create a public forum for examining individual trace files with a broader audience for a collective learning experience. Trace files will be gathered from attendees prior to SharkFest and only given to the panel members during the session so that the \u201cnot-\r\nknowing what to expect and whether it can be solved\u201d experience of working through an unknown trace file can be preserved.\r\nCome to this session and learn to ask the right questions and look at packets in different ways.\r\nPLEASE SEND PERPLEXING TRACE FILES FOR ANALYSIS BY THE PANEL TO jasper@packet-foo.com PRIOR TO SHARKFEST!", "description": "", "recording_license": "", "do_not_record": true, "persons": [{"code": "8HYSYC", "name": "Jasper Bongertz", "avatar": "https://conference.wireshark.org/media/avatars/JJLHFE_AA3w1ru.webp", "biography": "Jasper is the Head of the Computer Security Incident Response Team (CSIRT) at G Data CyberDefense in Bochum, Germany. In that role he is running a team of computer/network/memory forensics experts as well as a couple of malware reverse engineers and a number of Incident Handlers. The CSIRT helps customers that have been compromised (A.K.A. \"hacked\"), mostly with the attacker's intent of preparing/performing a ransomware extortion.\r\n\r\nJasper's official role at the G Data CSIRT is \"Principal Network Security Specialist\". He has over 20 years of experience in computer network analysis and network forensics, and has forgotten more about network protocols than most people will ever learn (Token Ring, ATM, some serial stuff). In previous employments he wrote and taught a number of Ethereal & Wireshark 3-5 day classes as well as official VMware classes, and Hacking courses. \r\n\r\nJasper is a Wireshark Certified Analyst (WCA #2) and member of the board of directors of the Wireshark Foundation.", "public_name": "Jasper Bongertz", "guid": "01090920-dcf6-5bfc-8ce9-c09dfc5e857c", "url": "https://conference.wireshark.org/sf26us/speaker/8HYSYC/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/A7BFDV/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/A7BFDV/", "attachments": []}, {"guid": "23c4e456-e7e8-5262-84d5-8d6685eadd93", "code": "FTMZDH", "id": 198, "logo": "https://conference.wireshark.org/media/sf26us/submissions/FTMZDH/Logo_zB5ntT7_EeoWRFg_99P09kh.webp", "date": "2026-07-22T15:15:00-05:00", "start": "15:15", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-198-from-specs-to-packets-generating-binary-exchange-dissectors-at-scale", "url": "https://conference.wireshark.org/sf26us/talk/FTMZDH/", "title": "From Specs to Packets: Generating Binary Exchange Dissectors at Scale", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "The Open Markets Initiative (OMI) has generated millions of lines of Lua dissector code for hundreds of binary electronic-trading protocols. This talk explains how we model binary protocols and why binary protocols form their own field of computer science. We will look at real exchange protocols covering how we go from a messy pdf spec to a Wireshark dissector. The session traces the evolution of code generation from early source generators to OMI\u2019s advanced binary data modeling, showing how this shift enabled a large ecosystem of accurate, production-grade dissectors maintained through crowdsourcing. Along the way, we\u2019ll examine what makes a scalable binary dissector, why protocol-driven development changes the rules, and how Wireshark helped form the OMI.", "description": "This talk presents the Open Markets Initiative (OMI) as a research platform built around a protocol-driven approach to dissector generation. OMI has produced over four million lines of Lua dissectors for real-world binary exchange protocols. The core idea is that the protocol binary data model itself, not the dissector, is the primary artifact. Once the protocol is captured in a structured, reusable form, multiple classes of tooling can be generated from it, with Wireshark dissectors as a key output.\r\n\r\nWe will examine several classes of exchange protocols and show how OMI\u2019s generator differs from earlier iterations of code generation tools, \u201cgenerations of generators.\u201d Instead of emitting code from message templates, flat schemas or other domain specific languages, our binary data models encode protocol semantics, constraints, and structural variation explicitly. This allows families of related protocols to share definitions, makes version evolution tractable, and produces dissectors that are both predictable and auditable. Using real examples, we\u2019ll show how generator design choices directly affect correctness, maintainability, and crowd contribution.\r\n\r\nThe entire electronic trading industry benefits from the open-source Wireshark and dissector ecosystem. Many exchange protocols are underspecified, implicitly defined, or guarded by information barriers. OMI turns reverse-engineering knowledge into shared specifications that can be reviewed, improved, and extended collaboratively. That process has led to a rapid expansion of accurate, production-grade dissectors, many of which are now relied on as primary analysis tools in the electronic-trading ecosystem.\r\n\r\nThe session is aimed at attendees interested in protocol modeling, code generation, advanced dissector design, and the ways open tooling can transform opaque binary systems into observable, debuggable infrastructure.", "recording_license": "", "do_not_record": false, "persons": [{"code": "HHS7AP", "name": "William Tegel", "avatar": "https://conference.wireshark.org/media/avatars/HHS7AP_NIO61Of.webp", "biography": "The Open Markets Initiative. CTO at Scaled Sources.", "public_name": "William Tegel", "guid": "2205ca0e-3c5f-5e16-afdb-5b0fef4bcb8a", "url": "https://conference.wireshark.org/sf26us/speaker/HHS7AP/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/FTMZDH/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/FTMZDH/", "attachments": []}, {"guid": "9eb468bc-732f-58fd-9379-b0f333a9be68", "code": "EZKBZW", "id": 255, "logo": null, "date": "2026-07-22T16:30:00-05:00", "start": "16:30", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-255-tcp-sack-overview-and-impact-on-performance", "url": "https://conference.wireshark.org/sf26us/talk/EZKBZW/", "title": "TCP SACK Overview and Impact on Performance", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "TCP SACK is an important performance enhancement to TCP. Learn the details of how to interpret the SACK field and relate it to performance of the application, using a very interesting case study from an actual customer.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "QQVD3Z", "name": "John Pittle", "avatar": null, "biography": "As a Performance Management Strategist, John helps his customers develop and execute strategies for integrating Performance Management as an IT discipline across the organization. He has been actively focused on Performance Engineering and Analysis for networks, systems, and applications since the early 90s; performance troubleshooting is his passion and joy. His packet analysis toolbox includes Wireshark (of course), as well as NetShark, AppResponse, Packet Analyzer, and Transaction Analyzer.", "public_name": "John Pittle", "guid": "a0c62c9e-a48b-504e-be3e-c6b14d4764c8", "url": "https://conference.wireshark.org/sf26us/speaker/QQVD3Z/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/EZKBZW/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/EZKBZW/", "attachments": []}, {"guid": "8f159cfd-8698-561d-af48-f1473a3ecc87", "code": "FYWGV9", "id": 197, "logo": "https://conference.wireshark.org/media/sf26us/submissions/FYWGV9/shark_waci_j4GEXty.png", "date": "2026-07-22T17:45:00-05:00", "start": "17:45", "duration": "00:45", "room": "Hermitage ABC | General Session", "slug": "sf26us-197-1-feeding-frenzy-of-wild-ideas-when-sharks-brainstorm", "url": "https://conference.wireshark.org/sf26us/talk/FYWGV9/", "title": "Feeding Frenzy of Wild Ideas: When Sharks Brainstorm", "subtitle": "", "track": "Beginner", "type": "Organization", "language": "en", "abstract": "Innovation doesn\u2019t always start with a perfectly reasonable idea\u2014sometimes it starts with something gloriously absurd. This session invites both developers and users to surface their most unconventional, impractical, or outright bizarre ideas for Wireshark and packet analysis. Nothing is too silly, too quirky, or too infeasible to share.\r\n\r\nBy creating a space free of judgment and full of curiosity, we open the door to unexpected breakthroughs. 99 wild suggestions may go nowhere\u2026 but the 100th can trigger a spark that becomes a feature, a tool, or even a whole new product direction.\r\nJoin us for an hour where creativity takes the wheel, seriousness stays at the shore, and every idea\u2014no matter how ridiculous\u2014gets its moment in the water.\r\n\r\nThis is open-house / open-door. Just come in and have some fun throwing ideas around", "description": "*Goal:*\r\nGenerate offbeat, humorous, impossible or \u201cwhy would anyone even\u2026\u201d suggestions that just might reveal a surprisingly valuable insight for Wireshark\u2019s future capabilities.\r\n\r\n*Format:*\r\n* Why absurd ideas matter.\r\n* Warm Up\r\n* Open SharkTank\r\n* The \u2018Maybe\u2026\u2019 scan\r\n\r\n*Ground Rules:*\r\n* All ideas are welcome.\r\n* No shooting down concepts\u2014only building on them.\r\n* Humor encouraged; feasibility optional.\r\n* The wilder, the better.\r\n\r\n*Who Should Attend:*\r\nAnyone who uses Wireshark, contributes to it, builds tooling around it, or likes thinking sideways. No technical depth required\u2014just curiosity and a willingness to have fun.", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/FYWGV9/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/FYWGV9/", "attachments": []}, {"guid": "918ac0d9-676b-509f-af51-3a553570d800", "code": "WVUP7Q", "id": 188, "logo": null, "date": "2026-07-22T18:30:00-05:00", "start": "18:30", "duration": "03:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-188-sponsor-technology-showcase-reception-espcape-group-packet-challenge-and-dinner", "url": "https://conference.wireshark.org/sf26us/talk/WVUP7Q/", "title": "Sponsor Technology Showcase Reception, esPCAPe Group Packet Challenge and Dinner", "subtitle": "", "track": "Organization", "type": "Dinner", "language": "en", "abstract": "Sponsor showcase, group packet challenge and dinner", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/WVUP7Q/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/WVUP7Q/", "attachments": []}], "Hermitage D | Classroom": [{"guid": "e75788b9-ac20-595b-bcd7-9fe22a5b1abb", "code": "M8KMKW", "id": 165, "logo": "https://conference.wireshark.org/media/sharkfest-25-us/submissions/M8KMKW/Teaser_K1luPWE.PNG", "date": "2026-07-22T10:15:00-05:00", "start": "10:15", "duration": "01:00", "room": "Hermitage D | Classroom", "slug": "sf26us-165-don-t-blame-the-network-ask-the-network", "url": "https://conference.wireshark.org/sf26us/talk/M8KMKW/", "title": "Don\u2019t blame the network \u2013 ask the network!", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "When systems have problems often times engineers say it is a network problem\u2026 and they\u2019ll say this without any actual data pointing the finger at the network. Sometimes it is a blamestorming session \u2013 database group is blaming the network, network is blaming the software, software is blaming the hardware speed, and hardware is blaming the database.\r\n\r\nWhen this happens, the best thing to do is kick everyone out of the room, sniff the data, and see where/what the bottleneck is. More often than not it isn\u2019t one particular thing but the interactions between two endpoints that just don\u2019t completely like each other. Identifying that is the first step in getting the right groups talking to each other and resolving the root of the issue.\r\n\r\nIn this talk I\u2019ll setup N real world scenarios, describe the problem, show the captured data and how if you ask the capture in the right way how the problem will reveal itself.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "ZRKXP3", "name": "David Soussan", "avatar": null, "biography": "I'm a geek and not afraid to wear my propeller hat in public. Started programming at age 12 (1976) taking a community college course on Fortran IV programming punching cards and found I just 'got it' ... to the point I was spending a lot of time helping the other \"kids\" in the course with their machine problems. At one point I asked my professor \"Do they actually pay people to do this?\" to which he replied \"Oh yes!\"... \"I'm going to do this for the rest of my life!\" and have.", "public_name": "David Soussan", "guid": "10f99448-2701-5c4b-92c3-58ece06241ca", "url": "https://conference.wireshark.org/sf26us/speaker/ZRKXP3/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/M8KMKW/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/M8KMKW/", "attachments": []}, {"guid": "d7f5423b-15ae-54ae-838e-9fcac84f5909", "code": "RKVN3B", "id": 202, "logo": null, "date": "2026-07-22T11:30:00-05:00", "start": "11:30", "duration": "01:00", "room": "Hermitage D | Classroom", "slug": "sf26us-202-understanding-lte-5g-3gpp-packet-flow-and-network-analysis", "url": "https://conference.wireshark.org/sf26us/talk/RKVN3B/", "title": "Understanding LTE & 5G: 3GPP Packet Flow and Network Analysis", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "we'll walk through how a device connects to an LTE network, from initial access to an active data session, and examined the packet flows that make that connection possible. We also look at how 3GPP protocols structure this communication and how tunneling is used to carry traffic across the network. Providing a clearer understanding of how LTE networks operate and explore similar concepts as they evolve into 5G.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "LKKWAR", "name": "Mark Stout", "avatar": null, "biography": "Currently working on 5G feature development and support, while bringing over 14 years of experience supporting LTE infrastructure.", "public_name": "Mark Stout", "guid": "52f4461d-c166-5b72-91c6-ed3edd7dcbac", "url": "https://conference.wireshark.org/sf26us/speaker/LKKWAR/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/RKVN3B/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/RKVN3B/", "attachments": []}, {"guid": "7ab2d545-dc49-5a1f-9708-90baabfbac00", "code": "8BDMAY", "id": 203, "logo": "https://conference.wireshark.org/media/sf26us/submissions/8BDMAY/image_divJyM9.webp", "date": "2026-07-22T15:15:00-05:00", "start": "15:15", "duration": "01:00", "room": "Hermitage D | Classroom", "slug": "sf26us-203-topology-based-pcap-analysis-wireshark-integrated-insight-beyond-packet-lists", "url": "https://conference.wireshark.org/sf26us/talk/8BDMAY/", "title": "Topology-Based PCAP Analysis: Wireshark-Integrated Insight Beyond Packet Lists", "subtitle": "", "track": "Intermediate", "type": "Presentation", "language": "en", "abstract": "Packet analysis tools present traffic as linear sequences, requiring analysts to reconstruct relationships mentally. This session introduces a topology-based approach that visualises PCAP data as a graph of hosts and interactions, enabling immediate structural understanding.\r\n\r\nUsing real examples, including DNS failure caused by misconfigured routing, we compare traditional packet list workflows with topology-driven analysis. The approach reduces cognitive load, accelerates diagnosis, and highlights patterns that are difficult to see in sequential views.\r\n\r\nThe session also demonstrates a Wireshark-integrated workflow using PDML export, allowing packet captures to be transferred directly into GalaxyTracer for interactive topology visualisation and anomaly analysis.", "description": "Traditional packet analysis relies on sequential inspection of frames, which can obscure higher-level structure and slow down diagnosis, particularly for less experienced analysts. However, network behaviour is inherently relational, involving hosts, conversations, and protocol groupings.\r\n\r\nThis session presents a practical approach to PCAP analysis using real-time topology visualisation. Instead of focusing on individual packets, traffic is represented as a graph of nodes (hosts) and edges (conversations), allowing analysts to immediately identify communication patterns, dependencies, and anomalies.\r\n\r\nA core case study will demonstrate a DNS resolution failure caused by a misconfigured gateway. In a standard packet list, this requires careful inspection of ARP requests, repeated DNS queries, and missing responses. In a topology view, the same issue is visible at a glance: a central host attempting external communication, combined with a misleading local dependency and no successful continuation.\r\n\r\nThe session will show how topology-based analysis:\r\n\r\nReduces cognitive load by externalising relationships\r\nAccelerates identification of failure patterns\r\nSupports both novice learning and expert triage workflows\r\nComplements, rather than replaces, traditional packet inspection\r\n\r\nAttendees will leave with a new mental model for analysing network traffic, and practical techniques for integrating structural reasoning into their existing workflows.", "recording_license": "", "do_not_record": false, "persons": [{"code": "NZUA8L", "name": "Ryan Younger", "avatar": "https://conference.wireshark.org/media/avatars/NZUA8L_f6VRg1q.webp", "biography": "Ryan Younger is an Assistant Professor of Computer Science at Olivet Nazarene University, specialising in cybersecurity, network analysis, and applied AI. He has 30 years of industry experience, having worked at companies including Google, Meta, Microsoft, Cisco, and eBay on large-scale systems, security, and user-facing technologies.", "public_name": "Ryan Younger", "guid": "5a116c28-d1af-5f1a-a9c2-4a2f3c0d1129", "url": "https://conference.wireshark.org/sf26us/speaker/NZUA8L/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/8BDMAY/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/8BDMAY/", "attachments": []}, {"guid": "ef7a8f51-8317-5419-a04a-1ada7e856795", "code": "RTCHM3", "id": 239, "logo": null, "date": "2026-07-22T16:30:00-05:00", "start": "16:30", "duration": "01:00", "room": "Hermitage D | Classroom", "slug": "sf26us-239-attacks-in-the-network-a-look-at-real-world-malicious-traffic-examples", "url": "https://conference.wireshark.org/sf26us/talk/RTCHM3/", "title": "Attacks in the Network - A look at real world malicious traffic examples", "subtitle": "", "track": "Security", "type": "Presentation", "language": "en", "abstract": "It's not easy to spot attacks in network packets, mostly because there's so many of them (packets, that is), resulting in the Signal-to-Noise ratio is extremely high. But there are also additional challenges, like encryption or attackers simply using protocols that administrators use themselves. We'll take a look at a number of real world scenarios and learn about various attack patterns and how to find/recognize them.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "8HYSYC", "name": "Jasper Bongertz", "avatar": "https://conference.wireshark.org/media/avatars/JJLHFE_AA3w1ru.webp", "biography": "Jasper is the Head of the Computer Security Incident Response Team (CSIRT) at G Data CyberDefense in Bochum, Germany. In that role he is running a team of computer/network/memory forensics experts as well as a couple of malware reverse engineers and a number of Incident Handlers. The CSIRT helps customers that have been compromised (A.K.A. \"hacked\"), mostly with the attacker's intent of preparing/performing a ransomware extortion.\r\n\r\nJasper's official role at the G Data CSIRT is \"Principal Network Security Specialist\". He has over 20 years of experience in computer network analysis and network forensics, and has forgotten more about network protocols than most people will ever learn (Token Ring, ATM, some serial stuff). In previous employments he wrote and taught a number of Ethereal & Wireshark 3-5 day classes as well as official VMware classes, and Hacking courses. \r\n\r\nJasper is a Wireshark Certified Analyst (WCA #2) and member of the board of directors of the Wireshark Foundation.", "public_name": "Jasper Bongertz", "guid": "01090920-dcf6-5bfc-8ce9-c09dfc5e857c", "url": "https://conference.wireshark.org/sf26us/speaker/8HYSYC/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/RTCHM3/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/RTCHM3/", "attachments": []}]}}, {"index": 6, "date": "2026-07-23", "day_start": "2026-07-23T04:00:00-05:00", "day_end": "2026-07-24T03:59:00-05:00", "rooms": {"Hermitage ABC | General Session": [{"guid": "4179ae7d-b93f-5ae6-af16-24a04d3b04b4", "code": "EUUK7H", "id": 192, "logo": null, "date": "2026-07-23T09:00:00-05:00", "start": "09:00", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-192-sharkbytes", "url": "https://conference.wireshark.org/sf26us/talk/EUUK7H/", "title": "SharkBytes", "subtitle": "", "track": "Organization", "type": "Organization", "language": "en", "abstract": "SharkBytes consist of \u201clittle crunchy bits of wisdom.\u201d Like popular TED talks, SharkBytes aim to inform, inspire, surprise, and delight by delivering a speech on a personal topic in under 5 minutes.\r\n\r\nInformation and a review of past SharkByte presentations can be found https://sharkfest.wireshark.org/sharkbytes\r\n\r\nEmail us your SharkByte session idea: sharkfest@wireshark.org", "description": "", "recording_license": "", "do_not_record": false, "persons": [], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/EUUK7H/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/EUUK7H/", "attachments": []}, {"guid": "485b8707-f8e8-51e0-af34-7e7591a90e68", "code": "SJTHY9", "id": 204, "logo": null, "date": "2026-07-23T10:15:00-05:00", "start": "10:15", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-204-examining-nat-behavior-with-wireshark-wca-core-topic", "url": "https://conference.wireshark.org/sf26us/talk/SJTHY9/", "title": "Examining NAT behavior with Wireshark - WCA Core Topic", "subtitle": "", "track": "Beginner", "type": "Presentation", "language": "en", "abstract": "The use of Network Address Translation in networks is unavoidable.  In this session, we will examine the different use cases of NAT and the design and application of those use cases.  We will use Wireshark to examine how NAT modifies fields in the IP and TCP header and how that can aid/hinder network troubleshooting.  Attendees can expect an interactive session where we work together to understand the details of NAT operation and usage.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "LVXUVN", "name": "Ross Bagurdes", "avatar": "https://conference.wireshark.org/media/avatars/Bagurdes_Headshot_SjVuW0O.jpeg", "biography": "Ross Bagurdes is a IT engineer and educator working with and teaching networking for more than 25 years.  He has authored dozens of training coures about CCNA, Network +, Wireshark, Firewalls, and more at Pluralsight, and has helped more than 1,000,000 people get education in network technology.  Today Ross works with the Wireshark Foundation to manage the Wireshark Certified Analyst program, as well as teaching courses on how to use Wireshark to successfully troubleshoot protocols and networks. In his personal time, you'll find Ross and his dog Dory walking along the beaches in San Diego, CA.", "public_name": "Ross Bagurdes", "guid": "0def5250-101e-527e-a22d-2ffc2ecf9ad9", "url": "https://conference.wireshark.org/sf26us/speaker/LVXUVN/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/SJTHY9/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/SJTHY9/", "attachments": []}, {"guid": "aed488e3-f964-5b46-9c4f-c6265d20a467", "code": "7X7YG3", "id": 208, "logo": null, "date": "2026-07-23T11:30:00-05:00", "start": "11:30", "duration": "01:00", "room": "Hermitage ABC | General Session", "slug": "sf26us-208-understanding-and-analyzing-web-performance", "url": "https://conference.wireshark.org/sf26us/talk/7X7YG3/", "title": "Understanding and Analyzing Web Performance", "subtitle": "", "track": "Beginner", "type": "Presentation", "language": "en", "abstract": "Why is the website slow?\r\n\r\nThis simple question can spawn a whole world of complexity, so let's take a tour through it!\r\n\r\nWe will use browser developer tools as our north star, diving into packets as well as internal net-export logs to show what's happening at every step of a web request. By translating the waterfall to the wire, we'll be able to understand common web performance bottlenecks and the quick fixes that make them disappear. \r\n\r\nFinally, we'll take a peek at energy-aware web design to see how a website can mindfully sip power rather than burning through a battery. \r\n\r\nYou will leave this session with the tools and understanding to debug modern websites.", "description": "", "recording_license": "", "do_not_record": true, "persons": [{"code": "LJMB8P", "name": "Josh Clark", "avatar": "https://conference.wireshark.org/media/avatars/a6cf3a193a4d11c2267b2c91698d3492_ikPSVyM.jpg", "biography": "Josh has both academic and real-world experience in the world of protocol analysis. He holds an M.S. degree in Computer Engineering with a focus in network engineering and has spent the past 8 years designing, troubleshooting, and optimizing networks and applications. He is a Wireshark Certified Analyst.", "public_name": "Josh Clark", "guid": "29a8c981-dca2-5ee5-aa17-869b6103ca3b", "url": "https://conference.wireshark.org/sf26us/speaker/LJMB8P/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/7X7YG3/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/7X7YG3/", "attachments": []}], "Hermitage D | Classroom": [{"guid": "2d573846-0a1f-59e6-9eb4-316612d84587", "code": "YNP8WZ", "id": 246, "logo": null, "date": "2026-07-23T10:15:00-05:00", "start": "10:15", "duration": "01:00", "room": "Hermitage D | Classroom", "slug": "sf26us-246-ai-found-holes-in-our-cheese", "url": "https://conference.wireshark.org/sf26us/talk/YNP8WZ/", "title": "AI Found Holes In Our Cheese", "subtitle": "", "track": "Security", "type": "Presentation", "language": "en", "abstract": "This past spring, the software world was rocked by AI vulnerability storm, as the state of the art in AI vulnerability scanning advanced rapidly, and flaws were found in the software that we use every day. Wireshark wasn't spared from this, and in this talk Gerald will show how Wireshark was impacted, and the processes and tools that the development team uses to protect Wireshark from security issues.", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "T8PUVR", "name": "Gerald Combs", "avatar": null, "biography": null, "public_name": "Gerald Combs", "guid": "e80ddc9a-7193-5265-8936-399d1dbe61a3", "url": "https://conference.wireshark.org/sf26us/speaker/T8PUVR/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/YNP8WZ/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/YNP8WZ/", "attachments": []}, {"guid": "8dbd4860-0002-50d6-b1b0-ca6ab3bf5151", "code": "TPZ79F", "id": 210, "logo": null, "date": "2026-07-23T11:30:00-05:00", "start": "11:30", "duration": "01:00", "room": "Hermitage D | Classroom", "slug": "sf26us-210-troubleshooting-with-wireshark-and-how-to-explain-your-findings", "url": "https://conference.wireshark.org/sf26us/talk/TPZ79F/", "title": "Troubleshooting with Wireshark and how to explain your findings", "subtitle": "", "track": "Beginner", "type": "Presentation", "language": "en", "abstract": "Work in progress but session to demonstrate troubleshooting with Wireshark and other tools and how to present findings to audiences of different technical levels", "description": "", "recording_license": "", "do_not_record": false, "persons": [{"code": "JWGFUK", "name": "Patrick Barber", "avatar": null, "biography": "Coming Soon", "public_name": "Patrick Barber", "guid": "fde8599e-1c6c-55b3-909f-24a84122a26e", "url": "https://conference.wireshark.org/sf26us/speaker/JWGFUK/"}], "links": [], "feedback_url": "https://conference.wireshark.org/sf26us/talk/TPZ79F/feedback/", "origin_url": "https://conference.wireshark.org/sf26us/talk/TPZ79F/", "attachments": []}]}}]}}}