Duration
5 days
PREREQUISITES
- Knowledge of networking
COURSE OBJECTIVES
At the end of this course, you should be able to:
- Identifying glitches in network performance because of high path latency
- Locating those devices on the network that tend to drop packets
- Validating optimal configuration of network hosts
- Analyzing dependencies and application functionalities
- Optimizing application behavior for best performance
- Learning the functions of TCP/IP networks
- Analyzing the capacity of a network before launching applications
- Verifying security of an application during log in, launch, and data transfer
- Spotting unusual network traffic activity indicating potential compromised hosts
- Identifying and reporting issues using graphs such as slow server performance, packet loss, receiver congestion, and network queuing amount others
COURSE DESCRIPTION
Wireshark is the one of the most popular network analyzer tools available worldwide. To successfully achieve Wireshark Certified Network Analyst certification, a candidate needs to establish his expertise in network analysis for security and performance purposes in an enterprise environment. You will gain insider tips and tricks so that you can quickly spot performance issues. The intensive training program will include many case studies offering insight into various security and performance issues faced by companies and how to solve them using Wireshark.
Introduction
- Locating Wireshark
- Starting the capture of data
- Configuring the start window
- Using time values and summaries
- Configuring coloring rules and navigation techniques
- Saving, printing, and exporting data
- Configuring the user interface in the Preferences menu
- Configuring protocol preferences
Introduction
- Configuring capture filters
- Configuring Ethernet filters
- Configuring host and network filters
- Configuring TCP / UDP and port filters
- Configuring compound filters
- Configuring byte offset and payload matching filters
Introduction
- Configuring display filters
- Configuring Ethernet, ARP, host, and network filters
- Configuring TCP / UDP filters
- Configuring specific protocol filters
- Configuring substring operator filters
- Configuring macros
Introduction
- Using the Summary tool from the Statistics menu
- Using the Protocol Hierarchy tool from the Statistics menu
- Using the Conversations tool from the Statistics menu
- Using the Endpoints tool from the Statistics menu
- Using the HTTP tool from the Statistics menu
- Configuring Flow Graph for viewing TCP flows
- Creating IP-based statistics
Introduction
- Configuring IO Graphs with filters for measuring network performance issues
- Throughput measurements with IO Graph
- Advanced IO Graph configurations with advanced Y-Axis parameters
- Getting information through TCP stream graphs – the Time-Sequence (Stevens) window
- Getting information through TCP stream graphs – the Time-Sequence (tcp-trace) window
- Getting information through TCP stream graphs – the Throughput Graph window
- Getting information through TCP stream graphs – the Round Trip Time window
- Getting information through TCP stream graphs – the Window Scaling Graph window
Introduction
- The Expert Infos window and how to use it for network troubleshooting
- Error events and undersstanding them
- Warnings events and understanding them
- Notes events and understanding them
Introduction
- Discovering broadcast and error storms
- Analyzing Spanning Tree Protocols
- Analyzing VLANs and VLAN tagging issues
- Analyzing wireless (Wi-Fi) problems
Introduction
- Analyzing connectivity problems with ARP
- Using IP traffic analysis tools
- Using GeoIP to look up physical locations of the IP address
- Finding fragmentation problems
- Analyzing routing problems
- Finding duplicate IPs
- Analyzing DHCP problems
Introduction
- Configuring TCP and UPD preferences for troubleshooting
- TCP connection problems
- TCP retransmission – where do they come from and why
- Duplicate ACKs and fast retrasmissions
- TCP out-of-order packet events
- TCP zero Window, Window Full, Window Change, and other Window indicators
- TCP resets and why they happen
Introduction
- Filtering DNS traffic
- Analyzing regular DNS operations
- Analyzing DNS problems
- Filtering HTTP traffic
- Configuring HTTP preferences
- Analyzing HTTP problems
- Exporting HTTP objects
- HTTP flow analysis and the Follow TCP Stream window
- Analyzing HTTPS traffic – SSL/TLCS basics
Introduction
- Finding out what is running over your network
- Analyzing FTP problems
- Analyzing e-mail traffic and troubleshooting e-mail problems – POP, IMAP, and SMTP
- Analyzing MS-TS and Citirx communications problems
- Analyzing problems in the NetBIOS protocols
- Analyzing database traffic and common problems
Introduction
- Using Wireshark’s features for telephony and multimedia analysis
- Analyzing SIP connectivity
- Analyzing RTP/RTCP connectivity
- Troubleshooting scenarios for video and surveillance applications
- Troubleshooting scenarios for IPTV applications
- Troubleshooting scenarios for video conferencing applications
- Troubleshooting RSTP
Introduction
- Measuring total bandwidth on a communication link
- Measuring bandwidth and throughput per user and per application over a network connection
- Monitoring jitter and delay using Wireshark
- Discovering delay/jitter-related application problems
Introduction
- Discovering unusual traffic patterns
- Discovering MAC- and ARP-based attacks
- Discovering ICMP and TCP SYN/Port scans
- Discovering DoS and DDoS attacks
- Locating smart TCP attacks
- Discovering brute-force and application attacks
Programme scope, delivery arrangements and suitability are confirmed during enquiry.