Free Online Course · Self-paced
Wireshark Tutorial for Network Analysis & Troubleshooting
Free, hands-on Wireshark tutorial covering capture, filters, decryption, TCP/UDP analysis, TLS/IPsec inspection, and real-world troubleshooting. 35+ packet-level examples with sample .pcap files included.
- 38 parts
- ~247 min total
- Beginner to Advanced
- Updated May 2026
Wireshark is the world's most-used network protocol analyzer - and learning to read packet captures is one of the highest-leverage skills a network or security engineer can build. This tutorial takes you from your very first capture all the way to decrypting TLS handshakes and writing custom dissectors, with hands-on examples for every common protocol.
We start with the basics (how to capture, how filters work, how to build reusable profiles), then dive into TCP internals - sequence numbers, retransmissions, zero-window, fragmentation. From there we cover HTTP, DNS, ARP, TLS decryption, IPsec, Kerberos, LDAPS, RADIUS, and the security-side topics that come up constantly in real incidents (rogue DHCP, duplicate IPs, malicious resource detection, log4j-style traffic analysis).
Click Start the course to begin with "How to use Wireshark", or jump straight to the protocol you are troubleshooting. The TCP, TLS, and Security chapters are the most-bookmarked.
What you'll learn
- Capture, filter, and analyze packets across all common protocols (HTTP, TLS, DNS, ARP, LDAP, Kerberos, IPsec)
- Build advanced display filters and reusable configuration profiles
- Decrypt SSL/TLS, LDAPS, and IPsec traffic for legitimate troubleshooting
- Diagnose real network problems - retransmissions, zero-window, fragmentation, rogue DHCP, ARP duplicates
- Use Wireshark for security analysis - malicious resource detection, phishing analysis, log4j-style vulnerabilities
Prerequisites
- A workstation with Wireshark installed (Linux, macOS, or Windows)
- Basic networking knowledge - TCP/IP, OSI layers, what an IP address is
- Root/admin privileges to capture from network interfaces
Syllabus
9 chapters · 38 lessons · ~247 min of reading
-
1 Getting Started with Wireshark 3 lessons
-
2 TCP Deep Dive 6 lessons
- Part 4 TCP sequence and acknowledgement numbers explained 6 min read
- Part 5 TCP receive window explained 5 min read
- Part 6 Diagnose TCP zero-window with Wireshark 6 min read
- Part 7 TCP retransmissions - causes and analysis 7 min read
- Part 8 Packet fragmentation in Wireshark 8 min read
- Part 9 Troubleshooting with TTL values 6 min read
-
3 HTTP, DNS, ARP and Common Protocols 5 lessons
-
4 TLS / SSL Decryption and Analysis 7 lessons
- Part 15 Decrypt SSL/TLS traffic in Wireshark 6 min read
- Part 16 Troubleshoot TLS handshake failures 10 min read
- Part 17 Analyze TLS / mTLS sessions 6 min read
- Part 18 Decrypt HTTPS / LDAPS traffic 8 min read
- Part 19 Analyze LDAP traffic 7 min read
- Part 20 Kerberos authentication packet analysis 6 min read
- Part 21 Decrypt RDP traffic (with Frida) 6 min read
-
5 IPsec / VPN Analysis 2 lessons
-
6 AAA, RADIUS and Network Policy Server 7 lessons
- Part 24 AAA and Network Policy Server overview 6 min read
- Part 25 Set up and test AAA with NPS (Part 2) 6 min read
- Part 26 Set up PEAP MS-CHAPv2 with NPS 6 min read
- Part 27 Configure FreeRADIUS PAP/CHAP authentication 8 min read
- Part 28 FreeRADIUS - LDAP authentication & authorization 6 min read
- Part 29 Integrate FreeRADIUS with Active Directory 6 min read
- Part 30 Configure VRRP with keepalived 6 min read
-
7 Performance and Bandwidth 3 lessons
-
9 Remote Capture and Advanced 2 lessons
