Post Views: 26,104

2.5-Day Instructor-Led Hands-On Lab Course
Available through Web-Based Live Delivery or On-Site Delivery
Minimum 10 Students – Maximum 16 Students

What Students are saying about this class

“Instructor has great depth on the topics and can present them in terms and uses examples that simplify.”
“The instructor ensures that the students understand the current topic before moving to the next.”
“The course material was well thought out, especially the labs.”
“Instructor has a lot of knowledge, and is able to transmit it without becoming boring. He knows very well how to keep the attention from the audience. You are one of the best online instructors I’ve had, good job!”

Course Description

Once you understand the fundamentals of Wireshark and basic packet analysis, the next challenge is learning how to use the application more efficiently and how to turn packet-level evidence into meaningful troubleshooting conclusions.

The Advanced Packet Analysis with Wireshark course is designed for experienced Wireshark users who are ready to move beyond basic packet capture and protocol inspection. Students develop advanced skills involving Wireshark profiles, ring buffers, capture techniques, display filters, filter macros, statistics, graphing, name resolution, troubleshooting workflows, and detailed TCP analysis.

A major focus of the course is learning how to approach packet analysis systematically. Students explore where and how to capture traffic, how to isolate relevant packets, how to recognize patterns in large captures, how to use Wireshark’s statistics and visualization capabilities, and how to drill down from a network symptom to packet-level evidence.

The course also examines an increasingly important challenge in modern packet analysis: encryption. Students explore what Wireshark can and cannot reveal when protocols such as HTTPS, QUIC, and IPsec are present and learn how useful conclusions can still be developed from the information that remains visible.

The final portion of the course provides a detailed examination of TCP. Students learn how to customize Wireshark for TCP analysis and investigate conversation completeness, the three-way handshake, performance behavior, Selective Acknowledgment, duplicate acknowledgments, common TCP issues, TCP failures, and a repeatable troubleshooting workflow.

This is a hands-on advanced course. The emphasis is not simply on learning additional Wireshark features, but on developing the analysis process and troubleshooting discipline required to use those features effectively.

This course helps answer questions such as:

How can ring buffers be used for longer or intermittent packet captures?
What are the limitations of packet analysis when network traffic is encrypted?
How can advanced display-filter buttons and filter macros improve analysis efficiency?
How can I/O graphs and TCP graphs expose network behavior and performance problems?
How can Wireshark be incorporated into a structured network troubleshooting process?
What can detailed TCP analysis reveal about network and application performance?

Course Objectives

Upon successful completion of this course, students will be able to:

Elevate existing Wireshark packet-capture and packet-analysis skills to an advanced level.
Apply advanced Wireshark filtering and capture-file operations.
Develop a deeper understanding of how Wireshark can be used for network and protocol analysis and monitoring.
Apply advanced Wireshark methods and procedures to improve analysis efficiency and tool utilization.
Expand packet-analysis and network-troubleshooting expertise through structured troubleshooting techniques.
Develop a deeper understanding of TCP behavior and its effect on network performance.

Audience

This course is designed for networking professionals who already understand the fundamental operation of Wireshark and want to develop more advanced packet-analysis and troubleshooting skills.

Ideal participants include:

Sales and technical marketing professionals working with Internet and networking technologies
Operations personnel responsible for network configuration, monitoring, and support
Network design engineers who use Wireshark as a troubleshooting and analysis tool
Technical sales professionals who need to correlate product features with actual network behavior
Technical marketing professionals who need more than a basic understanding of Wireshark
Network administrators

The course is particularly valuable for network engineers, technicians, operations personnel, test engineers, customer-support professionals, and analysts who regularly work with packet captures and need to progress from simply observing packets to performing disciplined network and protocol analysis.

Course Prerequisites

This is an advanced Wireshark course. Students should have previous experience using Wireshark or should have completed a Wireshark fundamentals course.

Students should already be comfortable with fundamental Wireshark operations such as capturing traffic, navigating packet details, opening and saving capture files, and applying basic display filters.

Students should attend with a laptop computer running Windows, macOS, or Linux.

When the course is delivered in a classroom where suitable computers are provided, a student laptop may not be required.

Class size is limited to 16 students.

Course Materials

Students receive a PDF Course Student Guide. Packet captures and supporting analysis exercises are also provided through the CellStream Online School of Network Science.

Course Outline

Section 1: Course Introduction and Logistics

Section 2: Wireshark Power-User Operations

Wireshark Custom Profiles
Wireshark Ring Buffers
Understanding the Limits of Encryption – QUIC, HTTPS, and IPsec

Section 3: Advanced Capture Tools and Filtering

Physical Network Taps
Mirror Ports
Applying Capture Filters

Section 4: Advanced Display Filtering

Display Filter Buttons
Display Filter Macros

Section 5: Advanced Statistics and Graphing

I/O Graphing with Filters
TCP Graphing and Visualization

Section 6: Advanced Name Resolution – Using Ethers and Hosts Files

Section 7: Wireshark Troubleshooting

Troubleshooting Preparation
Troubleshooting Tools
Troubleshooting Checklist
Drilling Down

Section 8: TCP Drilldown

Customizing Wireshark for TCP Protocol Analysis
TCP Conversation Completeness
TCP Three-Way Handshake
TCP Performance
TCP Selective Acknowledgment (SACK)
TCP Duplicate Acknowledgments
TCP Issues
TCP Failures
The TCP Troubleshooting Workflow

Section 9: Course Summary and Conclusions

Course Availability:

View the course calendar and browse for our schedule. It will show scheduled courses and available dates for scheduling.

CSI-HO-020-L – Advanced Packet Analysis with Wireshark- 2.5 Day