Hands on Wireshark Lab and Wireshark Certified Analyst Prep
Practical Wireshark Troubleshooting is a two-day, hands-on course designed to strengthen your packet analysis and troubleshooting skills. On Day 1, Ross Bagurdes guides you through Wireshark’s key features, capture methods, filtering techniques, and foundational protocols at the Data Link and Network layers. On Day 2, Chris Greer takes you deeper into Transport and Application layer analysis, focusing on TCP, UDP, and the tools that uncover real-world performance problems. By the end, you’ll know how to approach network issues with confidence — and be better prepared for the Wireshark Certified Analyst exam.
Innovation doesn’t always start with a perfectly reasonable idea—sometimes it starts with something gloriously absurd. This session invites both developers and users to surface their most unconventional, impractical, or outright bizarre ideas for Wireshark and packet analysis. Nothing is too silly, too quirky, or too infeasible to share.
By creating a space free of judgment and full of curiosity, we open the door to unexpected breakthroughs. 99 wild suggestions may go nowhere… but the 100th can trigger a spark that becomes a feature, a tool, or even a whole new product direction.
Join us for an hour where creativity takes the wheel, seriousness stays at the shore, and every idea—no matter how ridiculous—gets its moment in the water.
This is open-house / open-door. Just come in and have some fun throwing ideas around
Stratoshark brings Wireshark-style visibility to the Linux system, letting you see what's happening inside the OS alongside the network traffic it generates. In this hands-on workshop, you'll learn to use sysdig and Stratoshark to trace system calls, correlate them with packet data, and answer questions that packets alone can't — like which process handled a connection or how a service behaved under load. Designed for network engineers ready to go one level deeper, the session blends short lectures with guided exercises using cloud-based lab systems. You'll leave with a working understanding of Stratoshark and the confidence to begin using it in your own analysis.
Are you at Sharkfest for the first time? Then this session is for you. We'll explain how the conference works and what's probably different from other conference you may have been at. You'll learn about Packet Doctors, the evening events, the onsite WCA exam, and what the developer den is. The goal is to make sure you don't feel you missed out on something at the end of the conference because you didn't know how it worked.
Let's kick-off the conference in style!
Gerald Combs & Friends talk about the new developments over the past year
We give an overview over interesting tidbits with the Wireshark Development team as well as an outlook on version 5.0
DNS security doesn’t have to be confusing! In this session, we’ll break down DNSSEC, DoT, DoH, and DoQ in simple terms—what they do, how they’re different, and why you need to know when and where to use each one. We’ll take a hands-on look with Wireshark to see how these protocols actually behave at the packet level. By the end, you'll have a solid grasp of how to secure your DNS traffic, what Protective DNS really does, and how to pick the right tool for the job.
Beginners welcome. DNS newbies too.
The Wireshark Certified Analyst exam is not an easy certification to take, especially if your knowledge about the details of the TCP protocol is somewhat shaky. In this talk we'll take a look at the aspects mentioned in the WCA curriculum and discuss them together. The goal is to make sure you understand what you need to bring to the exam and help you identify the areas where you might have to improve your skill analyzing TCP to achieve the WCA status.
Finding and counting packet losts in each layer
Engineers at Pacific Northwest National Laboratory (PNNL) have been working to add support for MAC Privacy Protection protocol (IEEE 802.1AEdk) to the Linux kernel. MAC Privacy is a Layer 2 protocol intended primarily for use with MAC Security (IEEE 802.1AE) which can modify network traffic metadata including source and destination addresses, timing, and volume. Engineers decided early that having the ability to dissect this new network protocol in Wireshark would not only aid development and testing but also eventually be expected by the community. In this talk, engineers at PNNL present a new Wireshark dissector plugin for handling MAC Privacy protocol. They cover the plugin and its features as well as the pros and cons of developing a Wireshark plugin in Rust.
"Something is wrong with the network. I used to get 4Gbps transfers but now I'm only getting 120Mbps. Did you change something recently?"
Sound familiar? If you've spent any time supporting production systems, you've probably heard some variation of this complaint. Before jumping to conclusions about where the problem lies, we need to understand what's actually happening at the TCP layer on both endpoints.
AI is already changing how network engineers learn, troubleshoot, document, automate, and operate networks. But the opportunity is not to hand the network over to a chatbot. The opportunity is for hands-on practitioners to move up a level: defining better workflows, writing clearer requirements, setting stronger guardrails, validating results, and using AI as a force multiplier.
This talk introduces practical AI concepts for network engineers, including LLMs, agents, prompt workflows, API-based tooling, Spec-Driven Development, Test-Driven Development, and the role of deterministic automation alongside AI systems. We will walk through realistic NetOps use cases such as MOP review, incident summarization, log and packet capture analysis, Python and config generation, and an SDD-based workflow using real AI-assisted infrastructure design work.
The central message is simple: the next-generation network engineer does not stop being hands-on. The NGNE learns to think like an architect.
There is a veritable avalanche of wireless devices, from Wi-Fi and Bluetooth to Zigbee, aircraft, thermometers, door sensors, Lora mesh, and more. If you can't see it, you can't analyze it or debug it; we'll talk about ways to capture as many protocols flying around in the air as we can, and what the most affordable hardware to do it is.
Real life troubleshooting a difficult 3rd party software performance issue with using Wireshark and Advanced Analytics
Ever wondered what really happens inside a power substation during everyday operations? In this session, we’ll take a dynamic “flyover” of a small-to-medium-sized substation, exploring critical points where power and data intersect and uncovering the interactions that keep the power system stable and responsive.
We’ll look at how these elements work together to keep the lights on—and how their digital nervous system communicates in real time.
To bring it all together, we’ll walk through a real-world power system event, following the flow of communication from the initial fault detection all the way to the control center’s response and back to the field. Along the way, we’ll decode how these messages orchestrate recovery and maintain reliability. Whether you’re a packet sleuth or a power systems enthusiast, this session gives you a front-row seat to the intersection of operational technology and network analysis.
Sponsor Showcase and dinner
Before the rise of the internet (mid 1980s through the mid 1990’s , the packet and protocol ecosystem was much different than it was today. Many of the protocols have now gone extinct and new ones have risen in their place.
Moving from the world of serial protocols (e.g. HDLC/SDLC) to the Internet stack was a seismic shift, but the need to understand what’s on the wire only became more important.
What the transition was like, and why Wireshark was crucial in enabling it.
Your network never sleeps. Neither does your team — and that's the problem.
IT pros are on call at 3am, absorbing abuse from non-technical staff, and carrying the weight of every outage. The result? A workforce burning out quietly, abandoning their posts, snapping at their families, and turning to substances to cope. According to the CDC, suicide rates among IT professionals are quietly climbing. This discussion needs to happen now.
DJ Eshelman has 25+ years in IT consulting and has lived these stories firsthand. In this session, he breaks down how trauma accumulates in IT, why burnout is a management failure not a technology one, and what network leaders can do right now to stop the cycle.
You'll leave with: practical steps to protect your team, reduce technical debt, and retain the people keeping your infrastructure alive.
The biggest threat to your network isn't the next zero-day or patch gone bad. It's losing the people who defend it.
When systems have problems often times engineers say it is a network problem… and they’ll say this without any actual data pointing the finger at the network. Sometimes it is a blamestorming session – database group is blaming the network, network is blaming the software, software is blaming the hardware speed, and hardware is blaming the database.
When this happens, the best thing to do is kick everyone out of the room, sniff the data, and see where/what the bottleneck is. More often than not it isn’t one particular thing but the interactions between two endpoints that just don’t completely like each other. Identifying that is the first step in getting the right groups talking to each other and resolving the root of the issue.
In this talk I’ll setup N real world scenarios, describe the problem, show the captured data and how if you ask the capture in the right way how the problem will reveal itself.
Ever have a client fail to find an Apple TV? Or have slow or stuttering streaming?
Well, then look no more! AirPlay and other casting protocols are surprisingly complex, but with the help of packets, you can feel more confident troubleshooting.
we'll walk through how a device connects to an LTE network, from initial access to an active data session, and examined the packet flows that make that connection possible. We also look at how 3GPP protocols structure this communication and how tunneling is used to carry traffic across the network. Providing a clearer understanding of how LTE networks operate and explore similar concepts as they evolve into 5G.
The experts on this panel have been asked to look at a trace file and help find a reason for certain behaviors by attendees at many SharkFests. Based on this, they’ve decided to create a public forum for examining individual trace files with a broader audience for a collective learning experience. Trace files will be gathered from attendees prior to SharkFest and only given to the panel members during the session so that the “not-
knowing what to expect and whether it can be solved” experience of working through an unknown trace file can be preserved.
Come to this session and learn to ask the right questions and look at packets in different ways.
PLEASE SEND PERPLEXING TRACE FILES FOR ANALYSIS BY THE PANEL TO [email protected] PRIOR TO SHARKFEST!
The Open Markets Initiative (OMI) has generated millions of lines of Lua dissector code for hundreds of binary electronic-trading protocols. This talk explains how we model binary protocols and why binary protocols form their own field of computer science. We will look at real exchange protocols covering how we go from a messy pdf spec to a Wireshark dissector. The session traces the evolution of code generation from early source generators to OMI’s advanced binary data modeling, showing how this shift enabled a large ecosystem of accurate, production-grade dissectors maintained through crowdsourcing. Along the way, we’ll examine what makes a scalable binary dissector, why protocol-driven development changes the rules, and how Wireshark helped form the OMI.
Packet analysis tools present traffic as linear sequences, requiring analysts to reconstruct relationships mentally. This session introduces a topology-based approach that visualises PCAP data as a graph of hosts and interactions, enabling immediate structural understanding.
Using a real NetSupport RAT infection from a published malware-traffic-analysis.net exercise, we compare traditional packet list workflows with topology-driven analysis. The approach reduces cognitive load, accelerates diagnosis, and highlights patterns that are difficult to see in sequential views.
The session also demonstrates a Wireshark-integrated workflow using PDML export, and an AI analysis engine that runs entirely in the browser: an evidence-grounded triage layer that identifies the infected host, its C2 beacon, and the protocol disguise in seconds, without packet data ever leaving the machine.
TCP SACK is an important performance enhancement to TCP. Learn the details of how to interpret the SACK field and relate it to performance of the application, using a very interesting case study from an actual customer.
It's not easy to spot attacks in network packets, mostly because there's so many of them (packets, that is), resulting in the Signal-to-Noise ratio is extremely high. But there are also additional challenges, like encryption or attackers simply using protocols that administrators use themselves. We'll take a look at a number of real world scenarios and learn about various attack patterns and how to find/recognize them.
Innovation doesn’t always start with a perfectly reasonable idea—sometimes it starts with something gloriously absurd. This session invites both developers and users to surface their most unconventional, impractical, or outright bizarre ideas for Wireshark and packet analysis. Nothing is too silly, too quirky, or too infeasible to share.
By creating a space free of judgment and full of curiosity, we open the door to unexpected breakthroughs. 99 wild suggestions may go nowhere… but the 100th can trigger a spark that becomes a feature, a tool, or even a whole new product direction.
Join us for an hour where creativity takes the wheel, seriousness stays at the shore, and every idea—no matter how ridiculous—gets its moment in the water.
This is open-house / open-door. Just come in and have some fun throwing ideas around
Sponsor showcase, group packet challenge and dinner
SharkBytes consist of “little crunchy bits of wisdom.” Like popular TED talks, SharkBytes aim to inform, inspire, surprise, and delight by delivering a speech on a personal topic in under 5 minutes.
Information and a review of past SharkByte presentations can be found https://sharkfest.wireshark.org/sharkbytes
Email us your SharkByte session idea: [email protected]
The use of Network Address Translation in networks is unavoidable. In this session, we will examine the different use cases of NAT and the design and application of those use cases. We will use Wireshark to examine how NAT modifies fields in the IP and TCP header and how that can aid/hinder network troubleshooting. Attendees can expect an interactive session where we work together to understand the details of NAT operation and usage.
This past spring, the software world was rocked by AI vulnerability storm, as the state of the art in AI vulnerability scanning advanced rapidly, and flaws were found in the software that we use every day. Wireshark wasn't spared from this, and in this talk Gerald will show how Wireshark was impacted, and the processes and tools that the development team uses to protect Wireshark from security issues.
Why is the website slow?
This simple question can spawn a whole world of complexity, so let's take a tour through it!
We will use browser developer tools as our north star, diving into packets as well as internal net-export logs to show what's happening at every step of a web request. By translating the waterfall to the wire, we'll be able to understand common web performance bottlenecks and the quick fixes that make them disappear.
Finally, we'll take a peek at energy-aware web design to see how a website can mindfully sip power rather than burning through a battery.
You will leave this session with the tools and understanding to debug modern websites.
We will focus on troubleshooting with Wireshark and how to present your results to audiences of different technical levels with the use of Profiles, filters and other views in Wireshark. I will provide sample profiles and captures so you can follow along