Analyzing TCP connections is one of the biggest topics in network analysis in general, especially when troubleshooting applications or even multi-tiered deployments of servers. How TCP works and detecting problems is one of the 'easy to learn, hard to master' skills that is always in demand. Most Wireshark classes only touch the basics and do not go into the more complex scenarios, especially when it comes to multi point captures to track packet loss and timing issues. In this masterclass you will learn how to troubleshoot TCP in seemingly simple as well as complex and quite challenging cases.
The applications of today depend more and more on secure communication channels. For most internet applications the TLS protocol (still mostly referred to as SSL) is providing the secure channel to communicate over. To be able to troubleshoot problems with Applications that use (mutual) TLS, one must understand how TLS sessions are set up, how certificates and certificate authorities come into play and how you can look inside the encrypted traffic to analyse the (cleartext) application data. In this session you will gain a better understanding of the operation of the TLS protocol and more importantly, you will learn how to troubleshoot TLS based communications when things don't work as expected.
Let's kick off the conference in style
Gerald Combs & Friends talk about the new developments over the past year
This session will demonstrate the capability for Wireshark and tshark to be a more versatile tool for packet capture.
Unlock a groundbreaking approach to packet analysis with "Talk with Your Packets," where cutting-edge AI and Large Language Models (LLMs) meet the world of .pcap and .pcapng files. This session explores how natural language, combined with artificial intelligence and a Retrieval Augmented Generation (RAG) pipeline, can transform traditional packet analysis.
We’ll dive into how packets are converted into JSON representations via the CLI, chunked for efficient processing, embedded as vectors, and stored in ChromaDB for retrieval. Democratizing access to advanced packet analysis and making it easier for users to ask meaningful questions about their packet captures.
While this solution augments Wireshark by aiding in the filtering and crafting of high-value .pcaps (garbage in, garbage out), it does not replace Wireshark. Instead, it empowers analysts with a more intuitive and streamlined way to interpret packet data.
Using Sharkmon - Wireshark User can now finally start monitoring - using same syntax, same core technology - but for 1000s of pcap files - data over hours, days, months
End users and application teams complain to you about the latency, but we want to prove it is not network, how about that? The latency lies everywhere, not only in the network round trip time.
Wireshark and packet analysis shows us what happened but to understand the why behind what we see, we apply our expectation of what should happen to what we actually observe. To set the proper expectation, how we actually capture and the location of our diagnostic tool is important. This is a discussion of how we can determine where and how a capture is taken based on what we observe in our pcap files.
Join us for a fun night with an opportunity to enjoy wonderful conversations and win some nice prizes!
In modern Enterprise Networks, there are many different types of traffic - VoIP, Streaming Media, Backup/Replication Traffic, Web Browsing, and normal day to day traffic just to name a few. All of these are competing for the same bandwidth and resources, which leaves us as network administrators at times to play the role of packet traffic cop. We direct traffic at key intersections within the Enterprise environment and even pass our desired priorities to other higher-level networks that are out of our control. Quality Of Service can either be a dedicated partner, or our worst nightmare ....
This session will cover learning to capture and filter QoS related information within packets and using it to identify and troubleshoot issues. By using real world captures to identify DSCP marked packets, we see how to ensure they are correctly configured to achieve the desired priorities. Putting our packet patrol hats on, we can keep traffic flowing smoothly inside and outside our networks.
RFC 3271 spoke about the Internet being for everyone. Even today, in 2025, it isn't. Its functionality keeps growing and changing - new protocols are created - a good reason that Wireshark has a future! Despite its penetration, the Internet is not yet reliably for everyone. In this talk, I will review technical and policy considerations that must be treated to overcome to achieve an Internet that really is for everyone. Will AI help? A question worthy of exploration.
The experts on this panel have been asked to look at a trace file and help find a reason for certain behaviors by attendees at many SharkFests. Based on this, they’ve decided to create a public forum for examining individual trace files with a broader audience for a collective learning experience. Trace files will be gathered from attendees prior to SharkFest and only given to the panel members during the session so that the “not-
knowing what to expect and whether it can be solved” experience of working through an unknown trace file can be preserved.
Come to this session and learn to ask the right questions and look at packets in different ways.
PLEASE SEND PERPLEXING TRACE FILES FOR ANALYSIS BY THE PANEL TO [email protected] PRIOR TO SHARKFEST!
Wireless environments are complicated. Sometimes devices do not behave the way we expect. When these strange situations occur, how do you know whether your client device, AP, or other server resource is the issue? This presentation will review how to determine if devices are following the IEEE 802.11 standard and how to approach Wi-Fi issue resolution between client device and AP vendors.
With the recent release of Stratoshark, we finally have a familiar tool that helps us understand how the internals of servers and operating systems function. This talk will walk through some basic examples of how to set up and run sysdig to gather system call captures, and how to use Stratoshark to gain a deeper understanding of what runs on our networks.
From this talk, expect:
- Detailed sysdig and Stratoshark capture information
- Examples showing how packet data from Wireshark shows up in a Stratoshark capture
- Examples of real life troubleshooting with Stratoshark
Sake's esPCAPe Group Packet Challenge is back!
Come and enjoy an interesting session with learning interesting stuff about each other!
Pcap gives us a way to log packets - but pcap-NG gives us a way to log packets, packet-like objects, and environmental metadata to fully understand the capture. An introduction to generating pcap-NG logs from multiple (even hundreds) of interfaces, metadata, custom packet types, and custom meta-data.
Closing Remarks and Farewell reception