2.0 -//Pentabarf//Schedule//EN PUBLISH BSA8P7@@conference.wireshark.org -BSA8P7 Pre-Conference Class I: Practical Wireshark Skills for IT professionals en en 20260718T090000 20260718T170000 080000 Pre-Conference Class I: Practical Wireshark Skills for IT professionals Level up your Wireshark skills and get ready for Sharkfest! This hands-on course will provide core Wireshark skills for IT pros of all experience levels. Participants will gain a solid understanding of how to use Wireshark to capture, analyze, and troubleshoot network traffic. The course is designed with beginners in mind, but even seasoned packet people will pick up new tips and tricks. PUBLIC CONFIRMED Pre Conference Class https://conference.wireshark.org/sf26us/talk/BSA8P7/ Hermitage ABC | General Session Chris Greer Ross Bagurdes PUBLISH FYWGV9@@conference.wireshark.org -FYWGV9 Feeding Frenzy of Wild Ideas: When Sharks Brainstorm en en 20260718T170000 20260718T180000 010000 Feeding Frenzy of Wild Ideas: When Sharks Brainstorm *Goal:* Generate offbeat, humorous, impossible or “why would anyone even…” suggestions that just might reveal a surprisingly valuable insight for Wireshark’s future capabilities. *Format:* * Why absurd ideas matter. * Warm Up * Open SharkTank * The ‘Maybe…’ scan *Ground Rules:* * All ideas are welcome. * No shooting down concepts—only building on them. * Humor encouraged; feasibility optional. * The wilder, the better. *Who Should Attend:* Anyone who uses Wireshark, contributes to it, builds tooling around it, or likes thinking sideways. No technical depth required—just curiosity and a willingness to have fun. PUBLIC CONFIRMED Organization https://conference.wireshark.org/sf26us/talk/FYWGV9/ Hermitage ABC | General Session PUBLISH BSA8P7@@conference.wireshark.org -BSA8P7 Pre-Conference Class I: Practical Wireshark Skills for IT professionals en en 20260719T090000 20260719T170000 080000 Pre-Conference Class I: Practical Wireshark Skills for IT professionals Level up your Wireshark skills and get ready for Sharkfest! This hands-on course will provide core Wireshark skills for IT pros of all experience levels. Participants will gain a solid understanding of how to use Wireshark to capture, analyze, and troubleshoot network traffic. The course is designed with beginners in mind, but even seasoned packet people will pick up new tips and tricks. PUBLIC CONFIRMED Pre Conference Class https://conference.wireshark.org/sf26us/talk/BSA8P7/ Hermitage ABC | General Session Chris Greer Ross Bagurdes PUBLISH A3PJVZ@@conference.wireshark.org -A3PJVZ Pre-Conference Class II: Introduction to Stratoshark for Network Engineers en en 20260720T090000 20260720T170000 080000 Pre-Conference Class II: Introduction to Stratoshark for Network Engineers PUBLIC CONFIRMED Pre Conference Class https://conference.wireshark.org/sf26us/talk/A3PJVZ/ Hermitage ABC | General Session Josh Clark PUBLISH PGTGW3@@conference.wireshark.org -PGTGW3 Sharkfest How To Tutorial en en 20260720T170000 20260720T173000 003000 Sharkfest How To Tutorial This should be a **30 minute slot** right before the welcome dinner, if possible, or maybe parallel to the start of the welcome dinner. PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/PGTGW3/ Hermitage ABC | General Session Jasper Bongertz PUBLISH X73HTY@@conference.wireshark.org -X73HTY SharkFest'26 US Welcome Dinner & Sponsor Showcase en en 20260720T173000 20260720T203000 030000 SharkFest'26 US Welcome Dinner & Sponsor Showcase SharkFest'26 US Welcome Dinner & Sponsor Showcase PUBLIC CONFIRMED Dinner https://conference.wireshark.org/sf26us/talk/X73HTY/ Hermitage ABC | General Session PUBLISH H89ETP@@conference.wireshark.org -H89ETP Keynote: Wireshark Progress, Problems, and Plans en en 20260721T090000 20260721T100000 010000 Keynote: Wireshark Progress, Problems, and Plans PUBLIC CONFIRMED Organization https://conference.wireshark.org/sf26us/talk/H89ETP/ Hermitage ABC | General Session Gerald Combs PUBLISH GKG8F3@@conference.wireshark.org -GKG8F3 What is new in Wireshark en en 20260721T101500 20260721T111500 010000 What is new in Wireshark PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/GKG8F3/ Hermitage ABC | General Session Roland Knall PUBLISH DBPZAJ@@conference.wireshark.org -DBPZAJ Demystifying DNS Security: DNSSEC, DoT, DoH, DoQ - When and Where to Use them en en 20260721T113000 20260721T123000 010000 Demystifying DNS Security: DNSSEC, DoT, DoH, DoQ - When and Where to Use them PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/DBPZAJ/ Hermitage ABC | General Session Chris Greer PUBLISH SAY8D9@@conference.wireshark.org -SAY8D9 Lost In Transmission en en 20260721T133000 20260721T143000 010000 Lost In Transmission Packets lost occur in many situations, showing the shape in various layers. Differences in the number of packets between the passive start tap. (layer1,2) The same IPID and a different offset as disappearance in the packet buffer in the router processing Retransmission of TCP segments as a result of a traffic jam. UDP application works with packet loss. In this session, you can learn the major case of packet loss and you can find the way to find and count packet loss and retransmissions. Megumi shares the best way to understand invisible packet losses with Wireshark! PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/SAY8D9/ Hermitage ABC | General Session Megumi Takeshita PUBLISH XPYXAB@@conference.wireshark.org -XPYXAB Wireshark: The Prequel - What to do BEFORE you look at a capture en en 20260721T144500 20260721T154500 010000 Wireshark: The Prequel - What to do BEFORE you look at a capture This presentation is inspired by a series of articles I wrote on LinkedIn focused on practical, real world troubleshooting of application network performance issues. Instead of deep diving in to packet captures, this presentation will highlight the various tools and metrics available on Linux systems that help engineers and administrators pinpoint the true source(s) of application performance problems when "the network" is blamed. We will focus on how packets are processed in a Linux system from the NIC, through the OS, up to the application. We will then take a closer look at TCP itself, utilizing native Linux tooling to introspect on individual TCP socket performance. This TCP socket introspection will dive in to each socket's calculated network latency (RTT), packet sizing (MTU and MSS), and packet loss (retransmissions, SACK, duplicate ACKs PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/XPYXAB/ Hermitage ABC | General Session Rob MacDonald PUBLISH PNSKEA@@conference.wireshark.org -PNSKEA Capturing the spectrum of wireless packets en en 20260721T160000 20260721T170000 010000 Capturing the spectrum of wireless packets PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/PNSKEA/ Hermitage ABC | General Session Mike Kershaw PUBLISH LRBBM8@@conference.wireshark.org -LRBBM8 Packets in the Power Grid: A Journey Inside the Substation en en 20260721T171500 20260721T181500 010000 Packets in the Power Grid: A Journey Inside the Substation PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/LRBBM8/ Hermitage ABC | General Session Daniel Lopez PUBLISH WNWRRU@@conference.wireshark.org -WNWRRU Sponsor Technology Showcase Reception, Team Trivia for IT Nerds, and Dinner en en 20260721T183000 20260721T213000 030000 Sponsor Technology Showcase Reception, Team Trivia for IT Nerds, and Dinner PUBLIC CONFIRMED Dinner https://conference.wireshark.org/sf26us/talk/WNWRRU/ Hermitage ABC | General Session PUBLISH ZBAFXP@@conference.wireshark.org -ZBAFXP TCP details that matter for the WCA Exam en en 20260721T113000 20260721T123000 010000 TCP details that matter for the WCA Exam PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/ZBAFXP/ Hermitage D | Classroom Jasper Bongertz PUBLISH PDJYJ9@@conference.wireshark.org -PDJYJ9 MAC Privacy Protocol Wireshark Plugin en en 20260721T133000 20260721T143000 010000 MAC Privacy Protocol Wireshark Plugin PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/PDJYJ9/ Hermitage D | Classroom Cameron Smith PUBLISH CPNTMA@@conference.wireshark.org -CPNTMA NGNE with AI: Think Like an Architect en en 20260721T144500 20260721T154500 010000 NGNE with AI: Think Like an Architect Here is a slightly longer version of the abstract: AI is already changing how network engineers learn, troubleshoot, document, automate, and operate networks. But the opportunity is not to hand the network over to a chatbot. The opportunity is for hands-on practitioners to move up a level: defining better workflows, writing clearer requirements, setting stronger guardrails, validating results, and using AI as a force multiplier. This talk introduces practical AI concepts for network engineers, including LLMs, agents, prompt workflows, API-based tooling, Spec-Driven Development, Test-Driven Development, and the role of deterministic automation alongside AI systems. We will walk through realistic NetOps use cases such as MOP review, incident summarization, documentation cleanup, log and packet capture analysis, Python generation, config generation, and an SDD-based workflow using real AI-assisted infrastructure design work. The central message is simple: the next-generation network engineer does not stop being hands-on. The NGNE learns to think like an architect: designing workflows, constraining tools, reviewing ruthlessly, validating behavior, and using the right tool for the right job. PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/CPNTMA/ Hermitage D | Classroom Scott F Robohn PUBLISH BGPWJC@@conference.wireshark.org -BGPWJC Wireshark plus Advanced Analytics – Better Together (2 part session) en en 20260721T160000 20260721T181500 021500 Wireshark plus Advanced Analytics – Better Together (2 part session) Join us for a troubleshooting deep dive into solving a difficult problem occurring within Webex login from 2018, known as the 98% hang condition. We’ll showcase how the partnership of Wireshark and Advanced Analytics can be leveraged to quickly isolate the fault domain. Captures will be provided for use during the session. Session is half presentation and half hands-on lab with Wireshark. PUBLIC CONFIRMED Workshop https://conference.wireshark.org/sf26us/talk/BGPWJC/ Hermitage D | Classroom John Pittle PUBLISH 3BTBPN@@conference.wireshark.org -3BTBPN Keynote: Packets through the ages – A personal story en en 20260722T090000 20260722T100000 010000 Keynote: Packets through the ages – A personal story PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/3BTBPN/ Hermitage ABC | General Session Peter Jones PUBLISH ZSVEAS@@conference.wireshark.org -ZSVEAS Burnout Is Only the Beginning: How to Prevent a Buildup of Trauma in IT en en 20260722T101500 20260722T111500 010000 Burnout Is Only the Beginning: How to Prevent a Buildup of Trauma in IT **Why Your Network Is Only As Strong As The People Running It** You came to SharkFest to sharpen your technical skills. But this is the session that might change something more fundamental. Network engineers are among the most overworked, under-resourced professionals in any industry. The 3am calls, the constant firefighting, the impossible on-call expectations — they don't just create stress. Over time, they create trauma. And that trauma follows people from job to job, quietly compounding until it becomes a crisis. DJ Eshelman has 25+ years in IT consulting and has lived these stories firsthand. Now as an Independent Executive Director with Maxwell Leadership, he's dedicated to changing the IT Leadership world. In this session, he breaks down how trauma accumulates in technical environments, how to recognize the signs in yourself and your team, and critically, why most of it is a management problem, not a technology problem. You'll leave with: - A clear framework for understanding the IT trauma cycle (aka IT PTSD) - Practical steps managers can take immediately to protect their teams - Tools for structured priority management that reduce reactive chaos - An honest look at what actually retains great technical talent Prior attendees have had all-day discussions about this talk which tells us it is just that important right now. Whether you're an individual contributor, a team lead, or a department head, the health of the people running your network is just as mission-critical as the network itself. The biggest threat to your infrastructure isn't the next zero-day. It's losing the people who defend it. PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/ZSVEAS/ Hermitage ABC | General Session D. J. Eshelman PUBLISH VAHVRB@@conference.wireshark.org -VAHVRB Media Casting Protocols: Everything AirPlay, AirDrop and Wi-Fi Aware en en 20260722T113000 20260722T123000 010000 Media Casting Protocols: Everything AirPlay, AirDrop and Wi-Fi Aware We will walk through: -AirPlay vs AirDrop -The five phases of AirPlay -How to troubleshoot the phases over packet capture (802.11, BLE) and MacBook console -The changes to AirPlay above iOS 26 and Android support -Alternatives to AirPlay such as Wi-Fi Aware and Miracast, differences over in packet captures PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/VAHVRB/ Hermitage ABC | General Session Eva Santos PUBLISH A7BFDV@@conference.wireshark.org -A7BFDV The Packet Doctors are in! Packet trace examinations with the experts en en 20260722T133000 20260722T150000 013000 The Packet Doctors are in! Packet trace examinations with the experts PUBLIC CONFIRMED Packetdoctors Session https://conference.wireshark.org/sf26us/talk/A7BFDV/ Hermitage ABC | General Session Jasper Bongertz PUBLISH FTMZDH@@conference.wireshark.org -FTMZDH From Specs to Packets: Generating Binary Exchange Dissectors at Scale en en 20260722T151500 20260722T161500 010000 From Specs to Packets: Generating Binary Exchange Dissectors at Scale This talk presents the Open Markets Initiative (OMI) as a research platform built around a protocol-driven approach to dissector generation. OMI has produced over four million lines of Lua dissectors for real-world binary exchange protocols. The core idea is that the protocol binary data model itself, not the dissector, is the primary artifact. Once the protocol is captured in a structured, reusable form, multiple classes of tooling can be generated from it, with Wireshark dissectors as a key output. We will examine several classes of exchange protocols and show how OMI’s generator differs from earlier iterations of code generation tools, “generations of generators.” Instead of emitting code from message templates, flat schemas or other domain specific languages, our binary data models encode protocol semantics, constraints, and structural variation explicitly. This allows families of related protocols to share definitions, makes version evolution tractable, and produces dissectors that are both predictable and auditable. Using real examples, we’ll show how generator design choices directly affect correctness, maintainability, and crowd contribution. The entire electronic trading industry benefits from the open-source Wireshark and dissector ecosystem. Many exchange protocols are underspecified, implicitly defined, or guarded by information barriers. OMI turns reverse-engineering knowledge into shared specifications that can be reviewed, improved, and extended collaboratively. That process has led to a rapid expansion of accurate, production-grade dissectors, many of which are now relied on as primary analysis tools in the electronic-trading ecosystem. The session is aimed at attendees interested in protocol modeling, code generation, advanced dissector design, and the ways open tooling can transform opaque binary systems into observable, debuggable infrastructure. PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/FTMZDH/ Hermitage ABC | General Session William Tegel PUBLISH EZKBZW@@conference.wireshark.org -EZKBZW TCP SACK Overview and Impact on Performance en en 20260722T163000 20260722T173000 010000 TCP SACK Overview and Impact on Performance PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/EZKBZW/ Hermitage ABC | General Session John Pittle PUBLISH FYWGV9@@conference.wireshark.org -FYWGV9 Feeding Frenzy of Wild Ideas: When Sharks Brainstorm en en 20260722T174500 20260722T183000 004500 Feeding Frenzy of Wild Ideas: When Sharks Brainstorm *Goal:* Generate offbeat, humorous, impossible or “why would anyone even…” suggestions that just might reveal a surprisingly valuable insight for Wireshark’s future capabilities. *Format:* * Why absurd ideas matter. * Warm Up * Open SharkTank * The ‘Maybe…’ scan *Ground Rules:* * All ideas are welcome. * No shooting down concepts—only building on them. * Humor encouraged; feasibility optional. * The wilder, the better. *Who Should Attend:* Anyone who uses Wireshark, contributes to it, builds tooling around it, or likes thinking sideways. No technical depth required—just curiosity and a willingness to have fun. PUBLIC CONFIRMED Organization https://conference.wireshark.org/sf26us/talk/FYWGV9/ Hermitage ABC | General Session PUBLISH WVUP7Q@@conference.wireshark.org -WVUP7Q Sponsor Technology Showcase Reception, esPCAPe Group Packet Challenge and Dinner en en 20260722T183000 20260722T213000 030000 Sponsor Technology Showcase Reception, esPCAPe Group Packet Challenge and Dinner PUBLIC CONFIRMED Dinner https://conference.wireshark.org/sf26us/talk/WVUP7Q/ Hermitage ABC | General Session PUBLISH M8KMKW@@conference.wireshark.org -M8KMKW Don’t blame the network – ask the network! en en 20260722T101500 20260722T111500 010000 Don’t blame the network – ask the network! PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/M8KMKW/ Hermitage D | Classroom David Soussan PUBLISH RKVN3B@@conference.wireshark.org -RKVN3B Understanding LTE & 5G: 3GPP Packet Flow and Network Analysis en en 20260722T113000 20260722T123000 010000 Understanding LTE & 5G: 3GPP Packet Flow and Network Analysis PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/RKVN3B/ Hermitage D | Classroom Mark Stout PUBLISH 8BDMAY@@conference.wireshark.org -8BDMAY Topology-Based PCAP Analysis: Wireshark-Integrated Insight Beyond Packet Lists en en 20260722T151500 20260722T161500 010000 Topology-Based PCAP Analysis: Wireshark-Integrated Insight Beyond Packet Lists Traditional packet analysis relies on sequential inspection of frames, which obscures higher-level structure and slows diagnosis, particularly for less experienced analysts. Network behaviour is inherently relational, involving hosts, conversations, and protocol groupings. This session presents a practical approach to PCAP analysis using real-time topology visualisation. Traffic is represented as a graph of nodes (hosts) and edges (conversations), letting analysts immediately identify communication patterns, dependencies, and anomalies. A single case study anchors the session: a threat hunt through a real 15,000-packet NetSupport RAT capture from a published malware-traffic-analysis.net exercise. In a packet list the C2 channel hides in plain sight: one conversation among nearly a hundred external hosts, on port 443, dressed as TLS. In the topology it surfaces as a persistent edge that never goes quiet. The built-in AI analysis then completes the picture: a deterministic, evidence-first engine flags 273 requests on a fixed 60-second timer inside a single long-lived connection, plus cleartext HTTP on a TLS port whose User-Agent names the tooling itself. The analysis runs on-device in the browser, every claim is grounded in the capture, and the suggested display filters pivot straight back into packet-level verification, completing the incident report from verdict to infected host, hostname, and user. The session will show how topology-based analysis: Reduces cognitive load by externalising relationships Accelerates identification of attack and failure patterns Supports both novice learning and expert triage workflows Extends structural reasoning with grounded, on-device AI triage Complements, rather than replaces, traditional packet inspection Attendees will leave with a new mental model for analysing network traffic, and practical techniques for integrating structural reasoning and AI-assisted triage into their existing workflows. PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/8BDMAY/ Hermitage D | Classroom Ryan Younger PUBLISH RTCHM3@@conference.wireshark.org -RTCHM3 Attacks in the Network - A look at real world malicious traffic examples en en 20260722T163000 20260722T173000 010000 Attacks in the Network - A look at real world malicious traffic examples PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/RTCHM3/ Hermitage D | Classroom Jasper Bongertz PUBLISH EUUK7H@@conference.wireshark.org -EUUK7H SharkBytes en en 20260723T090000 20260723T100000 010000 SharkBytes PUBLIC CONFIRMED Organization https://conference.wireshark.org/sf26us/talk/EUUK7H/ Hermitage ABC | General Session PUBLISH SJTHY9@@conference.wireshark.org -SJTHY9 Examining NAT behavior with Wireshark - WCA Core Topic en en 20260723T101500 20260723T111500 010000 Examining NAT behavior with Wireshark - WCA Core Topic PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/SJTHY9/ Hermitage ABC | General Session Ross Bagurdes PUBLISH 7X7YG3@@conference.wireshark.org -7X7YG3 Understanding and Analyzing Web Performance en en 20260723T113000 20260723T123000 010000 Understanding and Analyzing Web Performance PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/7X7YG3/ Hermitage ABC | General Session Josh Clark PUBLISH YNP8WZ@@conference.wireshark.org -YNP8WZ AI Found Holes In Our Cheese en en 20260723T101500 20260723T111500 010000 AI Found Holes In Our Cheese PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/YNP8WZ/ Hermitage D | Classroom Gerald Combs PUBLISH TPZ79F@@conference.wireshark.org -TPZ79F Troubleshooting with Wireshark and how to explain your findings en en 20260723T113000 20260723T123000 010000 Troubleshooting with Wireshark and how to explain your findings PUBLIC CONFIRMED Presentation https://conference.wireshark.org/sf26us/talk/TPZ79F/ Hermitage D | Classroom Patrick Barber