-
The analysis software Wireshark, which emerged from the Ethereal project, is a powerful tool for network and system administrators. This course provides a solid foundation with a systematic introduction to the basic functions and operation of Wireshark as well as methods and techniques for monitoring, analyzing and troubleshooting networks at packet level and the differentiation of network and application problems. Building on this, participants will learn how to analyze and troubleshoot typical network technologies such as switched Ethernet and TCP/IP with Wireshark in detail. The TCP transport protocol in particular is examined in detail. The course has a high practical component and enables participants to carry out complex analyses with Wireshark independently. Course content and exercises are based on the latest Wireshark version.
-
Course Contents
-
- How the Wireshark Analyzer works
- Live Capture and Live Capture settings
- Display options and analysis options
- Display filter and capture filter
- Advanced functions: Presets, user profiles and name resolution
- Packet analysis methods and techniques
- Wireshark statistics and baselining
- Troubleshooting: localization of network and application problems
- Analysis of switched Ethernet: Duplex and speed, spanning tree and VLAN analysis
- TCP/IP analysis of the network layer for IPv4 and IPv6
- TCP/IP analysis of the transport layer
The detailed digital documentation package, consisting of an e-book and PDF, is included in the price of the course.
Premium Course Documents
In addition to the digital documentation package, the exclusive Premium Print Package is also available to you.
- High-quality color prints of the ExperTeach documentation
- Exclusive folder in an elegant design
- Document pouch in backpack shape
- Elegant LAMY ballpoint pen
- Practical notepad
The Premium Print Package can be added during the ordering process for € 200,- plus VAT (only for classroom participation).
-
Target Group
-
This workshop is suitable for networkers who want to learn how to use Wireshark to perform complex network and application analysis and troubleshooting.
-
Knowledge Prerequisites
-
Participants should be familiar with the Ethernet and TCP/IP environment. Prior attendance of one of the two courses TCP/IP or Ethernet, Routing & Switching - Technology Basics for Enterprise Networks is highly recommended.
| 1 | Introduction to Wireshark Analysis |
| 1.1 | What is Wireshark? |
| 1.1.1 | What is Wireshark able to see? |
| 1.1.2 | Wireshark Architecture |
| 1.1.3 | Installation and Operation of the Npcap Driver |
| 1.2 | Measuring in Ethernet Networks |
| 1.2.1 | Evaluation of Ethernet Data |
| 1.3 | Measuring in Wireless LAN Networks |
| 1.3.1 | Capture without Monitor Mode |
| 1.3.2 | Capture in Monitor Mode—Linux |
| 1.4 | First Steps with Wireshark |
| 1.4.1 | Capture Options |
| 1.4.2 | Display Filter during Capture |
| 1.4.3 | Saving a Capture |
| 1.4.4 | Setting the Language |
| 2 | Working with Wireshark |
| 2.1 | Display Options and Navigation |
| 2.1.1 | Preferences |
| 2.1.2 | Changing the View—Layout |
| 2.1.3 | Setting Fonts and Colors |
| 2.1.4 | Alignment of the Columns |
| 2.1.5 | Time Options |
| 2.1.6 | Saving the Settings |
| 2.1.7 | Find Packet |
| 2.2 | Preferences and Profiles |
| 2.2.1 | User Profiles—Configuration Profiles |
| 2.3 | Display Filters |
| 2.3.1 | Input and Syntax |
| 2.3.2 | The Filter Result |
| 2.3.3 | Basic Display Filters |
| 2.3.4 | Comparison Operators |
| 2.3.5 | Layer Operator—Multiple Fields |
| 2.3.6 | Filtering from a List of Values |
| 2.3.7 | Filter Text with contains and matches |
| 2.3.8 | Logical Operators |
| 2.3.9 | Saving Display Filters |
| 2.3.10 | "This" Filter |
| 2.3.11 | Context Filter—Apply as Filter |
| 2.3.12 | Context Filter—Conversation Filter |
| 2.3.13 | Filter from Statistics—Endpoints |
| 2.3.14 | Filter from Statistics—Conversations |
| 2.3.15 | Follow TCP Stream |
| 2.3.16 | Display Filter—Hints from Practical Application |
| 2.4 | Capture Options and Capture Filters |
| 2.4.1 | Preferences for the Capture |
| 2.4.2 | Capture Options—Input |
| 2.4.3 | Capture Options—Output |
| 2.4.4 | Capture Options |
| 2.4.5 | Capture Filter |
| 2.4.6 | Capturing File Sets |
| 2.4.7 | Several Interfaces |
| 2.5 | Input and Output |
| 2.5.1 | Input and Output—Save |
| 2.5.2 | Saving Filtered Packets |
| 2.5.3 | Input and Output—Export |
| 3 | Advanced Wireshark Analyzer Functions |
| 3.1 | Name Resolution |
| 3.1.1 | Name Resolution—Physical Addresses |
| 3.1.2 | Name Resolution—Transport Addresses |
| 3.1.3 | Name Resolution—Network Addresses |
| 3.2 | What is protocol reassembly? |
| 3.2.1 | Packet Reassembly: Example TCP |
| 3.2.2 | Packet Reassembly in Detail |
| 3.3 | Colors in the Packet List |
| 3.3.1 | Coloring Rules |
| 3.3.2 | Colorize Conversation |
| 3.3.3 | Colorize with Filter |
| 3.4 | Command Line—Command Line Tools |
| 3.4.1 | Command Line—capinfos |
| 3.4.2 | Command Line—tshark |
| 3.4.3 | Command Line—mergecap |
| 3.4.4 | Command Line—editcap |
| 4 | Wireshark Statistics |
| 4.1 | Statistics –> Properties of the Captured File |
| 4.2 | Protocol Hierarchy |
| 4.3 | Statistics—Endpoints |
| 4.4 | Statistics—Conversations |
| 4.5 | Statistics— I/O Graph |
| 4.6 | TCP Statistics |
| 4.6.1 | TCP Stream Graph—Round Trip Time |
| 4.6.2 | TCP Stream Graph—Data Rate |
| 4.6.3 | TCP Stream Graph—Window Scaling |
| 4.6.4 | TCP Stream Graph—Time Sequence Graph (Stevens) |
| 4.6.5 | TCP Stream Graph—Time Sequence Graph (tcptrace) |
| 4.7 | Limits of Wireshark Statistics |
| 5 | Analysis and Troubleshooting |
| 5.1 | Explain Packet Analysis |
| 5.1.1 | Network Documentation |
| 5.1.2 | Baselining |
| 5.2 | Systematic Error Isolation |
| 5.2.1 | Troubleshooting Methods |
| 5.2.2 | Bottom Up—Troubleshooting with the OSI Model |
| 5.3 | Troubleshooting in the Network without Wireshark |
| 5.3.1 | Duplex Mismatch in the Ethernet |
| 5.3.2 | Overload in the Router or in the WAN Interface |
| 5.3.3 | Packet Filters and Firewalls |
| 5.4 | Measurement Technology with Wireshark |
| 5.4.1 | Selecting Measuring Points |
| 5.4.2 | Port Monitoring—SPAN |
| 5.4.3 | Test Access Point—TAP |
| 5.4.4 | Wireshark on the End Device |
| 5.4.5 | Evaluation of VLAN and VLAN Tags |
| 5.5 | Sniffing in VMware |
| 5.5.1 | Promiscuous Mode for Standard vSwitch |
| 5.5.2 | Port Mirroring on Distributed vSwitch |
| 5.5.3 | ESXi CLI |
| 5.6 | Network Performance with Wireshark |
| 5.6.1 | Round Trip Time—Initial RTT |
| 5.6.2 | Round Trip Time—During a Connection |
| 5.6.3 | Service Response Time—SRT |
| 5.6.4 | Data Rate and Overhead |
| 5.7 | Analysis of Delay Problems |
| 5.7.1 | High Round Trip Times |
| 5.7.2 | High Service Response Times |
| 5.8 | Network Problems and Application Problems |
| 5.9 | Application Types and Performance Factors |
| 5.9.1 | Throughput-oriented Applications |
| 5.9.2 | Transaction-oriented Applications |
| 5.9.3 | Real-time applications—Voice and Streaming |
| 6 | TCP/IP Analysis of the Transport Layer |
| 6.1 | Transport over UDP and TCP |
| 6.1.1 | Addressing the Applications |
| 6.1.2 | UDP—Simple and Unacknowledged |
| 6.1.3 | TCP—Connection-oriented and Acknowledged |
| 6.2 | TCP Functions in Wireshark |
| 6.2.1 | TCP Connection Setup |
| 6.2.2 | Sequencing of Data |
| 6.2.3 | Disconnection |
| 6.2.4 | TCP Reset |
| 6.2.5 | Sequencing in Wireshark |
| 6.3 | TCP Window and Performance |
| 6.3.1 | Sliding Window Mechanism |
| 6.3.2 | Window Size in Wireshark |
| 6.3.3 | Window Mechanism and Performance |
| 6.3.4 | TCP Window Scaling Option |
| 6.3.5 | Bytes in Flight and Window Size |
| 6.4 | Packet Loss, Retransmissions, and Timing |
| 6.4.1 | Repetition in the Event of Packet Loss |
| 6.4.2 | Retransmissions in Wireshark |
| 6.4.3 | Isolating Retransmissions |
| 6.4.4 | Selective Acknowledgments (SACK) |
| 6.4.5 | Retransmission—Timing |
| 6.5 | Evaluating TCP Problems with Wireshark |
| 6.5.1 | RTT and RTO in Wireshark |
| 6.5.2 | Expert Information for TCP |
| 6.6 | Further TCP Functions |
| 6.6.1 | Delayed Acknowledgments |
| 6.6.2 | TCP Push |
| 6.7 | Hints for Troubleshooting |
| 7 | TCP/IP Analysis of the Network Layer |
| 7.1 | The Internet Protocol in an Overview |
| 7.1.1 | The Network Protocol and Its Addressing |
| 7.1.2 | IP Addressing and ARP |
| 7.1.3 | Duplicate IP Addresses |
| 7.2 | Dynamic Host Configuration Protocol (DHCP) |
| 7.2.1 | DHCP Default Functions: DORA |
| 7.2.2 | Further DHCP Functions |
| 7.2.3 | DHCP Relay |
| 7.2.4 | DHCP Statistics |
| 7.3 | MTU, PMTU, Fragmentation |
| 7.3.1 | MTU |
| 7.3.2 | IP Fragmentation |
| 7.3.3 | PMTU and PMTU Discovery |
| 7.3.4 | Adaptation of the MSS |
| 7.4 | Internet Control Message Protocol (ICMP) |
| 7.4.1 | ICMPv6 Echo and ICMPv6 Echo Reply |
| 7.4.2 | ICMP—Destination Unreachable |
| 7.4.3 | ICMP Time Exceeded |
| 7.5 | DNS Analysis |
| 7.5.1 | Functional Mode and Requests |
| 7.5.2 | DNS in Wireshark |
| 7.5.3 | Important DNS Types |
| 7.5.4 | DNS Error in Wireshark |
| 7.5.5 | DNS Response Times in Wireshark |
| 7.5.6 | Typical DNS Problems and Background |
| A | Wireshark—Protocol Analysis—Lab Exercises and Solutions |
| A.1 | Lab Exercises—Chapter 1 |
| A.2 | Lab Exercises—Chapter 2 |
| A.2.1 | Lab Exercise—Create Columns |
| A.2.2 | Lab Exercise—Configuration Profiles |
| A.2.3 | Lab Exercise—Display Filter |
| A.2.4 | Optional Lab Exercise—Find Packet |
| A.3 | Lab Exercises—Chapter 3 |
| A.3.1 | Lab Exercise—Advanced Profile Settings |
| A.3.2 | Lab Exercise—Command Line Tool—Part 1 |
| A.3.3 | Lab Exercise—Command Line Tool—Part 2 |
| A.3.4 | Lab Exercise—Command Line Tool—Part 3 |
| A.3.5 | Lab Exercise—Command Line Tool—Part 4 |
| A.4 | Lab Exercises—Chapter 4 |
| A.4.1 | Lab Exercise—Throughput and Time Sequence |
| A.4.2 | Lab Exercise—Evaluating a Speed Test |
| A.5 | Lab Exercises—Chapter 5 |
| A.5.1 | Lab Exercise—Throughput |
| A.5.2 | Lab Exercise—Overhead |
| A.5.3 | Lab Exercise—Efficiency and Maladjustment |
| A.6 | Lab Exercises—Chapter 6 |
| A.6.1 | Lab Exercise—TCP Connection Setup |
| A.6.2 | Lab Exercise—TCP Disconnection |
| A.6.3 | Lab Exercise—TCP Zero Window |
| A.6.4 | Lab Exercise—TCP Bandwidth Delay Product |
| A.6.5 | Lab Exercise—TCP Retransmissions—1 |
| A.6.6 | Lab Exercise—TCP Retransmissions—2 |
| A.6.7 | Optionally Lab Exercise—The Customer’s Trouble |
| A.7 | Lab Exercises—Chapter 7 |
| A.7.1 | Lab Exercise—DHCP with Windows 7 |
| A.7.2 | Lab Exercise—DHCP Decline |
| A.7.3 | Lab Exercise—IP Fragmentation |
| A.7.4 | Lab Exercise—PMTU Discovery |
| A.7.5 | Lab Exercise—Black Hole |
| A.7.6 | Lab Exercise—ICMP |
| A.7.7 | Lab Exercise—DNS Problems |
| A.7.8 | Lab Exercise—DNS Recursive Root Lookup |
| A.8 | Solutions for the Lab Exercises |
| A.8.1 | Solutions for the Lab Exercises—Chapter 2 |
| A.8.2 | Solutions for the Lab Exercises—Chapter 3 |
| A.8.3 | Solutions for the Lab Exercises—Chapter 4 |
| A.8.4 | Solutions for the Lab Exercises—Chapter 5 |
| A.8.5 | Solutions for the Lab Exercises—Chapter 6 |
| A.8.6 | Solutions for the Lab Exercises—Chapter 7 |
| B | References |
| B.1 | Capturing with Windows pktmon |
| B.2 | Links to Tools and Additional Information |
| B.3 | Advanced Display Filters |
| B.3.1 | Filtering on the Bit Layer |
| B.3.2 | Regular Expressions—Regex |
| B.3.3 | Examples of Display Filters |
| B.4 | Windows Registry Settings for TCP/IP |
| C | List of Abbreviations |
-
Classroom training
- Do you prefer the classic training method? A course in one of our Training Centers, with a competent trainer and the direct exchange between all course participants? Then you should book one of our classroom training dates!
-
Hybrid training
- Hybrid training means that online participants can additionally attend a classroom course. The dynamics of a real seminar are maintained, and the online participants are able to benefit from that. Online participants of a hybrid course use a collaboration platform, such as WebEx Training Center or Saba Meeting. To do this, a PC with browser and Internet access is required, as well as a headset and ideally a Web cam. In the seminar room, we use specially developed and customized audio- and video-technologies. This makes sure that the communication between all persons involved works in a convenient and fault-free way.
-
Online training
- You wish to attend a course in online mode? We offer you online course dates for this course topic. To attend these seminars, you need to have a PC with Internet access (minimum data rate 1Mbps), a headset when working via VoIP and optionally a camera. For further information and technical recommendations, please refer to.
-
Tailor-made courses
-
You need a special course for your team? In addition to our standard offer, we will also support you in creating your customized courses, which precisely meet your individual demands. We will be glad to consult you and create an individual offer for you.
You can find the complete description of this course with dates and prices ready for download at as PDF.-
The analysis software Wireshark, which emerged from the Ethereal project, is a powerful tool for network and system administrators. This course provides a solid foundation with a systematic introduction to the basic functions and operation of Wireshark as well as methods and techniques for monitoring, analyzing and troubleshooting networks at packet level and the differentiation of network and application problems. Building on this, participants will learn how to analyze and troubleshoot typical network technologies such as switched Ethernet and TCP/IP with Wireshark in detail. The TCP transport protocol in particular is examined in detail. The course has a high practical component and enables participants to carry out complex analyses with Wireshark independently. Course content and exercises are based on the latest Wireshark version.
-
Course Contents
-
- How the Wireshark Analyzer works
- Live Capture and Live Capture settings
- Display options and analysis options
- Display filter and capture filter
- Advanced functions: Presets, user profiles and name resolution
- Packet analysis methods and techniques
- Wireshark statistics and baselining
- Troubleshooting: localization of network and application problems
- Analysis of switched Ethernet: Duplex and speed, spanning tree and VLAN analysis
- TCP/IP analysis of the network layer for IPv4 and IPv6
- TCP/IP analysis of the transport layer
The detailed digital documentation package, consisting of an e-book and PDF, is included in the price of the course.
Premium Course Documents
In addition to the digital documentation package, the exclusive Premium Print Package is also available to you.
- High-quality color prints of the ExperTeach documentation
- Exclusive folder in an elegant design
- Document pouch in backpack shape
- Elegant LAMY ballpoint pen
- Practical notepad
The Premium Print Package can be added during the ordering process for € 200,- plus VAT (only for classroom participation).
-
Target Group
-
This workshop is suitable for networkers who want to learn how to use Wireshark to perform complex network and application analysis and troubleshooting.
-
Knowledge Prerequisites
-
Participants should be familiar with the Ethernet and TCP/IP environment. Prior attendance of one of the two courses TCP/IP or Ethernet, Routing & Switching - Technology Basics for Enterprise Networks is highly recommended.
| 1 | Introduction to Wireshark Analysis |
| 1.1 | What is Wireshark? |
| 1.1.1 | What is Wireshark able to see? |
| 1.1.2 | Wireshark Architecture |
| 1.1.3 | Installation and Operation of the Npcap Driver |
| 1.2 | Measuring in Ethernet Networks |
| 1.2.1 | Evaluation of Ethernet Data |
| 1.3 | Measuring in Wireless LAN Networks |
| 1.3.1 | Capture without Monitor Mode |
| 1.3.2 | Capture in Monitor Mode—Linux |
| 1.4 | First Steps with Wireshark |
| 1.4.1 | Capture Options |
| 1.4.2 | Display Filter during Capture |
| 1.4.3 | Saving a Capture |
| 1.4.4 | Setting the Language |
| 2 | Working with Wireshark |
| 2.1 | Display Options and Navigation |
| 2.1.1 | Preferences |
| 2.1.2 | Changing the View—Layout |
| 2.1.3 | Setting Fonts and Colors |
| 2.1.4 | Alignment of the Columns |
| 2.1.5 | Time Options |
| 2.1.6 | Saving the Settings |
| 2.1.7 | Find Packet |
| 2.2 | Preferences and Profiles |
| 2.2.1 | User Profiles—Configuration Profiles |
| 2.3 | Display Filters |
| 2.3.1 | Input and Syntax |
| 2.3.2 | The Filter Result |
| 2.3.3 | Basic Display Filters |
| 2.3.4 | Comparison Operators |
| 2.3.5 | Layer Operator—Multiple Fields |
| 2.3.6 | Filtering from a List of Values |
| 2.3.7 | Filter Text with contains and matches |
| 2.3.8 | Logical Operators |
| 2.3.9 | Saving Display Filters |
| 2.3.10 | "This" Filter |
| 2.3.11 | Context Filter—Apply as Filter |
| 2.3.12 | Context Filter—Conversation Filter |
| 2.3.13 | Filter from Statistics—Endpoints |
| 2.3.14 | Filter from Statistics—Conversations |
| 2.3.15 | Follow TCP Stream |
| 2.3.16 | Display Filter—Hints from Practical Application |
| 2.4 | Capture Options and Capture Filters |
| 2.4.1 | Preferences for the Capture |
| 2.4.2 | Capture Options—Input |
| 2.4.3 | Capture Options—Output |
| 2.4.4 | Capture Options |
| 2.4.5 | Capture Filter |
| 2.4.6 | Capturing File Sets |
| 2.4.7 | Several Interfaces |
| 2.5 | Input and Output |
| 2.5.1 | Input and Output—Save |
| 2.5.2 | Saving Filtered Packets |
| 2.5.3 | Input and Output—Export |
| 3 | Advanced Wireshark Analyzer Functions |
| 3.1 | Name Resolution |
| 3.1.1 | Name Resolution—Physical Addresses |
| 3.1.2 | Name Resolution—Transport Addresses |
| 3.1.3 | Name Resolution—Network Addresses |
| 3.2 | What is protocol reassembly? |
| 3.2.1 | Packet Reassembly: Example TCP |
| 3.2.2 | Packet Reassembly in Detail |
| 3.3 | Colors in the Packet List |
| 3.3.1 | Coloring Rules |
| 3.3.2 | Colorize Conversation |
| 3.3.3 | Colorize with Filter |
| 3.4 | Command Line—Command Line Tools |
| 3.4.1 | Command Line—capinfos |
| 3.4.2 | Command Line—tshark |
| 3.4.3 | Command Line—mergecap |
| 3.4.4 | Command Line—editcap |
| 4 | Wireshark Statistics |
| 4.1 | Statistics –> Properties of the Captured File |
| 4.2 | Protocol Hierarchy |
| 4.3 | Statistics—Endpoints |
| 4.4 | Statistics—Conversations |
| 4.5 | Statistics— I/O Graph |
| 4.6 | TCP Statistics |
| 4.6.1 | TCP Stream Graph—Round Trip Time |
| 4.6.2 | TCP Stream Graph—Data Rate |
| 4.6.3 | TCP Stream Graph—Window Scaling |
| 4.6.4 | TCP Stream Graph—Time Sequence Graph (Stevens) |
| 4.6.5 | TCP Stream Graph—Time Sequence Graph (tcptrace) |
| 4.7 | Limits of Wireshark Statistics |
| 5 | Analysis and Troubleshooting |
| 5.1 | Explain Packet Analysis |
| 5.1.1 | Network Documentation |
| 5.1.2 | Baselining |
| 5.2 | Systematic Error Isolation |
| 5.2.1 | Troubleshooting Methods |
| 5.2.2 | Bottom Up—Troubleshooting with the OSI Model |
| 5.3 | Troubleshooting in the Network without Wireshark |
| 5.3.1 | Duplex Mismatch in the Ethernet |
| 5.3.2 | Overload in the Router or in the WAN Interface |
| 5.3.3 | Packet Filters and Firewalls |
| 5.4 | Measurement Technology with Wireshark |
| 5.4.1 | Selecting Measuring Points |
| 5.4.2 | Port Monitoring—SPAN |
| 5.4.3 | Test Access Point—TAP |
| 5.4.4 | Wireshark on the End Device |
| 5.4.5 | Evaluation of VLAN and VLAN Tags |
| 5.5 | Sniffing in VMware |
| 5.5.1 | Promiscuous Mode for Standard vSwitch |
| 5.5.2 | Port Mirroring on Distributed vSwitch |
| 5.5.3 | ESXi CLI |
| 5.6 | Network Performance with Wireshark |
| 5.6.1 | Round Trip Time—Initial RTT |
| 5.6.2 | Round Trip Time—During a Connection |
| 5.6.3 | Service Response Time—SRT |
| 5.6.4 | Data Rate and Overhead |
| 5.7 | Analysis of Delay Problems |
| 5.7.1 | High Round Trip Times |
| 5.7.2 | High Service Response Times |
| 5.8 | Network Problems and Application Problems |
| 5.9 | Application Types and Performance Factors |
| 5.9.1 | Throughput-oriented Applications |
| 5.9.2 | Transaction-oriented Applications |
| 5.9.3 | Real-time applications—Voice and Streaming |
| 6 | TCP/IP Analysis of the Transport Layer |
| 6.1 | Transport over UDP and TCP |
| 6.1.1 | Addressing the Applications |
| 6.1.2 | UDP—Simple and Unacknowledged |
| 6.1.3 | TCP—Connection-oriented and Acknowledged |
| 6.2 | TCP Functions in Wireshark |
| 6.2.1 | TCP Connection Setup |
| 6.2.2 | Sequencing of Data |
| 6.2.3 | Disconnection |
| 6.2.4 | TCP Reset |
| 6.2.5 | Sequencing in Wireshark |
| 6.3 | TCP Window and Performance |
| 6.3.1 | Sliding Window Mechanism |
| 6.3.2 | Window Size in Wireshark |
| 6.3.3 | Window Mechanism and Performance |
| 6.3.4 | TCP Window Scaling Option |
| 6.3.5 | Bytes in Flight and Window Size |
| 6.4 | Packet Loss, Retransmissions, and Timing |
| 6.4.1 | Repetition in the Event of Packet Loss |
| 6.4.2 | Retransmissions in Wireshark |
| 6.4.3 | Isolating Retransmissions |
| 6.4.4 | Selective Acknowledgments (SACK) |
| 6.4.5 | Retransmission—Timing |
| 6.5 | Evaluating TCP Problems with Wireshark |
| 6.5.1 | RTT and RTO in Wireshark |
| 6.5.2 | Expert Information for TCP |
| 6.6 | Further TCP Functions |
| 6.6.1 | Delayed Acknowledgments |
| 6.6.2 | TCP Push |
| 6.7 | Hints for Troubleshooting |
| 7 | TCP/IP Analysis of the Network Layer |
| 7.1 | The Internet Protocol in an Overview |
| 7.1.1 | The Network Protocol and Its Addressing |
| 7.1.2 | IP Addressing and ARP |
| 7.1.3 | Duplicate IP Addresses |
| 7.2 | Dynamic Host Configuration Protocol (DHCP) |
| 7.2.1 | DHCP Default Functions: DORA |
| 7.2.2 | Further DHCP Functions |
| 7.2.3 | DHCP Relay |
| 7.2.4 | DHCP Statistics |
| 7.3 | MTU, PMTU, Fragmentation |
| 7.3.1 | MTU |
| 7.3.2 | IP Fragmentation |
| 7.3.3 | PMTU and PMTU Discovery |
| 7.3.4 | Adaptation of the MSS |
| 7.4 | Internet Control Message Protocol (ICMP) |
| 7.4.1 | ICMPv6 Echo and ICMPv6 Echo Reply |
| 7.4.2 | ICMP—Destination Unreachable |
| 7.4.3 | ICMP Time Exceeded |
| 7.5 | DNS Analysis |
| 7.5.1 | Functional Mode and Requests |
| 7.5.2 | DNS in Wireshark |
| 7.5.3 | Important DNS Types |
| 7.5.4 | DNS Error in Wireshark |
| 7.5.5 | DNS Response Times in Wireshark |
| 7.5.6 | Typical DNS Problems and Background |
| A | Wireshark—Protocol Analysis—Lab Exercises and Solutions |
| A.1 | Lab Exercises—Chapter 1 |
| A.2 | Lab Exercises—Chapter 2 |
| A.2.1 | Lab Exercise—Create Columns |
| A.2.2 | Lab Exercise—Configuration Profiles |
| A.2.3 | Lab Exercise—Display Filter |
| A.2.4 | Optional Lab Exercise—Find Packet |
| A.3 | Lab Exercises—Chapter 3 |
| A.3.1 | Lab Exercise—Advanced Profile Settings |
| A.3.2 | Lab Exercise—Command Line Tool—Part 1 |
| A.3.3 | Lab Exercise—Command Line Tool—Part 2 |
| A.3.4 | Lab Exercise—Command Line Tool—Part 3 |
| A.3.5 | Lab Exercise—Command Line Tool—Part 4 |
| A.4 | Lab Exercises—Chapter 4 |
| A.4.1 | Lab Exercise—Throughput and Time Sequence |
| A.4.2 | Lab Exercise—Evaluating a Speed Test |
| A.5 | Lab Exercises—Chapter 5 |
| A.5.1 | Lab Exercise—Throughput |
| A.5.2 | Lab Exercise—Overhead |
| A.5.3 | Lab Exercise—Efficiency and Maladjustment |
| A.6 | Lab Exercises—Chapter 6 |
| A.6.1 | Lab Exercise—TCP Connection Setup |
| A.6.2 | Lab Exercise—TCP Disconnection |
| A.6.3 | Lab Exercise—TCP Zero Window |
| A.6.4 | Lab Exercise—TCP Bandwidth Delay Product |
| A.6.5 | Lab Exercise—TCP Retransmissions—1 |
| A.6.6 | Lab Exercise—TCP Retransmissions—2 |
| A.6.7 | Optionally Lab Exercise—The Customer’s Trouble |
| A.7 | Lab Exercises—Chapter 7 |
| A.7.1 | Lab Exercise—DHCP with Windows 7 |
| A.7.2 | Lab Exercise—DHCP Decline |
| A.7.3 | Lab Exercise—IP Fragmentation |
| A.7.4 | Lab Exercise—PMTU Discovery |
| A.7.5 | Lab Exercise—Black Hole |
| A.7.6 | Lab Exercise—ICMP |
| A.7.7 | Lab Exercise—DNS Problems |
| A.7.8 | Lab Exercise—DNS Recursive Root Lookup |
| A.8 | Solutions for the Lab Exercises |
| A.8.1 | Solutions for the Lab Exercises—Chapter 2 |
| A.8.2 | Solutions for the Lab Exercises—Chapter 3 |
| A.8.3 | Solutions for the Lab Exercises—Chapter 4 |
| A.8.4 | Solutions for the Lab Exercises—Chapter 5 |
| A.8.5 | Solutions for the Lab Exercises—Chapter 6 |
| A.8.6 | Solutions for the Lab Exercises—Chapter 7 |
| B | References |
| B.1 | Capturing with Windows pktmon |
| B.2 | Links to Tools and Additional Information |
| B.3 | Advanced Display Filters |
| B.3.1 | Filtering on the Bit Layer |
| B.3.2 | Regular Expressions—Regex |
| B.3.3 | Examples of Display Filters |
| B.4 | Windows Registry Settings for TCP/IP |
| C | List of Abbreviations |
-
Classroom training
- Do you prefer the classic training method? A course in one of our Training Centers, with a competent trainer and the direct exchange between all course participants? Then you should book one of our classroom training dates!
-
Hybrid training
- Hybrid training means that online participants can additionally attend a classroom course. The dynamics of a real seminar are maintained, and the online participants are able to benefit from that. Online participants of a hybrid course use a collaboration platform, such as WebEx Training Center or Saba Meeting. To do this, a PC with browser and Internet access is required, as well as a headset and ideally a Web cam. In the seminar room, we use specially developed and customized audio- and video-technologies. This makes sure that the communication between all persons involved works in a convenient and fault-free way.
-
Online training
- You wish to attend a course in online mode? We offer you online course dates for this course topic. To attend these seminars, you need to have a PC with Internet access (minimum data rate 1Mbps), a headset when working via VoIP and optionally a camera. For further information and technical recommendations, please refer to.
-
Tailor-made courses
-
You need a special course for your team? In addition to our standard offer, we will also support you in creating your customized courses, which precisely meet your individual demands. We will be glad to consult you and create an individual offer for you.
You can find the complete description of this course with dates and prices ready for download at as PDF.
Guaranteed date
Classroom Training
Hybrid Training
Trainer language German