Introduction to Wireshark for TCP/IP Networking

Location: On-Site or Online
Pricing: $1,250 per seat (6-seat minimum)
Length: 3 Days

Course Summary

Introduction to Wireshark for TCP/IP Networking is a practical, hands-on course designed to teach students how to analyze, understand, and troubleshoot TCP/IP networks using Wireshark.

Students learn how network traffic actually behaves on the wire—far beyond diagrams and theory. The course focuses on packet capture techniques, protocol dissection, TCP/IP fundamentals, and real-world troubleshooting scenarios involving latency, packet loss, retransmissions, and misconfigurations.

By the end of the course, students are comfortable capturing traffic, filtering packets, interpreting protocol behavior, and using Wireshark as a core diagnostic tool for networking, security, and application support.

Course Outline

Day 1 – Networking Foundations and Wireshark Basics

• 💬 Lecture: Why packet analysis matters

• 💬 Lecture: Review of TCP/IP model and protocol layering

• 💬 Lecture: Frames, packets, segments, and encapsulation

• 💬 Lecture: Where Wireshark fits in troubleshooting workflows

• ⚙️ Lab: Installing Wireshark and validating the environment

• ⚙️ Lab: Exploring the Wireshark interface and packet list panes

• ⚙️ Lab: Capturing traffic on a live interface

• ⚙️ Lab: Identifying Ethernet, IP, TCP, and UDP headers

• ⚙️ Lab: Saving and reopening packet capture files

Day 2 – Packet Capture and Filtering Mastery

• 💬 Lecture: Capture vs display filters

• 💬 Lecture: Berkeley Packet Filter (BPF) fundamentals

• 💬 Lecture: Display filter syntax and logic

• ⚙️ Lab: Applying capture filters to limit traffic

• ⚙️ Lab: Building display filters for common protocols

• ⚙️ Lab: Filtering by IP address, port, and protocol

• ⚙️ Lab: Combining filters with AND / OR logic

• 💬 Lecture: Time, packets, and conversations

• ⚙️ Lab: Using time display formats

• ⚙️ Lab: Following TCP and UDP streams

• ⚙️ Lab: Viewing conversations and endpoints statistics

Day 3 – TCP, UDP, and Core Protocol Analysis

• 💬 Lecture: TCP connection lifecycle (3-way handshake, teardown)

• 💬 Lecture: Sequence numbers, acknowledgements, and windowing

• 💬 Lecture: Retransmissions, latency, and congestion indicators

• ⚙️ Lab: Analyzing a TCP three-way handshake

• ⚙️ Lab: Identifying retransmissions and duplicate ACKs

• ⚙️ Lab: Measuring round-trip time (RTT)

• ⚙️ Lab: Detecting slow connections and packet loss

• 💬 Lecture: UDP behavior and use cases

• 💬 Lecture: Common TCP/IP application protocols (DNS, HTTP)

• ⚙️ Lab: Analyzing DNS queries and responses

• ⚙️ Lab: Tracing HTTP request and response flows

• ⚙️ Lab: Differentiating TCP vs UDP traffic patterns

Day 4 – Real-World Troubleshooting and Analysis Techniques

• 💬 Lecture: Structured troubleshooting with packet captures

• 💬 Lecture: Identifying client vs server responsibility

• 💬 Lecture: Common network failure patterns

• ⚙️ Lab: Troubleshooting a slow application scenario

• ⚙️ Lab: Diagnosing a failed TCP connection

• ⚙️ Lab: Identifying MTU and fragmentation issues

• ⚙️ Lab: Detecting malformed or unexpected packets

• 💬 Lecture: Best practices for packet captures in production

• 💬 Lecture: Interpreting results and communicating findings

• ⚙️ Lab: Building a repeatable capture and analysis workflow

• ⚙️ Lab: Documenting findings from packet analysis

• ⚙️ Lab: Walking through an end-to-end TCP/IP troubleshooting exercise

Outcomes

Students who complete Introduction to Wireshark for TCP/IP Networking will be able to:

• Capture and analyze network traffic confidently

• Understand TCP/IP behavior at the packet level

• Use filters to isolate relevant traffic quickly

• Identify latency, packet loss, and retransmission issues

• Troubleshoot real-world network and application problems

• Communicate findings clearly using packet evidence