Cybersecurity Analysis with Wireshark and Tshark is a beginner course built from 30 guided packet-analysis labs. You learn the capture-file lifecycle from selecting an interface and recording live traffic to filtering, extracting, summarizing, exporting, rotating, compressing, and debugging packet data.
TShark command-line workflows form the core of the course, while several labs also open the Wireshark desktop interface for HTTP, DNS, IPv6, wireless, SMB, and Lua-related tasks. The exercises combine prepared capture files with live lab traffic so you can compare repeatable offline analysis with real-time observation.
What You Will Learn
After completing this course, you will be able to:
- List capture interfaces, record live traffic, apply BPF capture filters, limit packet count and snapshot length, and save PCAP or compressed capture files
- Read packet summaries and protocol details, change timestamp and hexadecimal views, and use two-pass analysis
- Apply Wireshark display filters, decode traffic on nonstandard ports, disable or enable dissectors, and export filtered packet subsets
- Analyze TCP conversations and streams, retransmissions, DNS activity, IPv6 traffic, HTTP requests and objects, wireless frames, and SMB response times
- Extract selected fields to CSV or JSON, generate protocol statistics, and pipe output through tools such as
grepandwc - Manage larger or continuous captures with subsets, ring-buffer file rotation, compression, real-time updates, performance timers, and diagnostic logs
- Load a Lua script and pass arguments to extend packet-processing behavior and capture custom output
Who This Course Is For
This course is for junior security analysts, network and system administrators, IT support professionals, and learners who want structured practice with packet captures and the Wireshark toolset.
Prerequisites: Basic familiarity with IP addresses, TCP and UDP ports, DNS, HTTP, and the Linux terminal is recommended. No previous Wireshark or TShark experience is required; the labs introduce options incrementally, although later exercises assume comfort combining them.
Learning environment: All 30 guided labs run in a privileged Ubuntu 22.04 desktop environment with terminal access, prepared PCAP files, and lab capture interfaces. Some exercises use sudo, live capture, Wireshark windows, or monitor mode. Capture traffic only in the lab or on networks where you have explicit permission.
Frequently Asked Questions
Does the course teach the Wireshark GUI or only TShark?
It teaches both, but the emphasis is TShark. Most objectives use command-line flags for repeatable capture and analysis, while selected labs use Wireshark windows and filter controls for HTTP, DNS, IPv6, wireless capture, service statistics, and Lua loading. It is not a tour of every GUI pane or menu.
Do I need networking experience before starting?
You do not need professional experience, but basic TCP/IP vocabulary will make the exercises more meaningful. The course teaches tool operations rather than explaining Ethernet, TCP handshakes, DNS, HTTP, IPv6, and SMB from first principles.
Will I work with live traffic or only saved PCAP files?
Both. Some labs capture from interfaces and monitor updates in real time; others read prepared or previously generated files so filtering, streams, exports, statistics, performance, and debugging can be reproduced consistently.
Is this a complete SOC, threat-hunting, or network-forensics course?
No. It develops broad operational fluency with Wireshark and TShark, including some troubleshooting and anomaly-oriented filters, but it does not provide a capstone investigation, adversary tradecraft, alert triage, TLS decryption, malware traffic analysis, evidence procedures, or incident reporting in depth.
