Protocol Analysis with Tshark develops a protocol-aware, command-line workflow for turning packet captures into readable conversations and structured evidence. Three guided labs cover capture and display filters, TCP stream reconstruction, field extraction, and CSV formatting; a final challenge asks you to identify command-and-control activity in a prepared PCAP.
You work in isolated Ubuntu 22.04 virtual machines with locally generated traffic and staged capture files. Rather than scanning packet summaries manually, you learn to query decoded HTTP and DNS fields, preserve analysis artifacts, and create output that shell tools or downstream analysis systems can consume.
What You Will Learn
- Capture traffic with Tshark, save PCAP evidence, and distinguish collection from offline analysis
- Apply protocol-aware display filters to isolate HTTP, DNS, IP, and request-specific traffic
- Generate protocol hierarchy statistics to assess the composition of a capture
- Identify TCP stream indexes and reconstruct complete HTTP request-response conversations
- Save reconstructed streams as reviewable text evidence and interpret GET and POST activity
- Extract selected frame, IP, DNS, HTTP URI, host, and User-Agent fields into clean CSV-style output
- Automate a threat-hunting workflow that deduplicates DNS queries and isolates a suspicious domain and download URI
Who This Course Is For
This course is for SOC learners, security analysts, network investigators, and Linux users who already understand basic packets and want richer protocol analysis than raw capture summaries provide. It is a natural follow-on to introductory tcpdump practice, though equivalent experience is sufficient.
Prerequisites: Basic Linux shell pipelines and redirection, plus familiarity with IP addresses, TCP streams, DNS, HTTP, ports, and PCAP files. Prior Tshark or Wireshark experience is not required.
Learning environment: Four independent activities in browser-accessible Ubuntu 22.04 virtual machines: three guided labs and one challenge. Tshark, locally generated DNS/HTTP traffic, sample captures, and a prepared suspicious PCAP are provided; no Wireshark desktop interface is used.
Frequently Asked Questions
How does this course differ from Packet Analysis with tcpdump?
The tcpdump course emphasizes interface capture, BPF, raw payload views, and PCAP handling. This course uses Tshark’s Wireshark dissectors and display filters to query named protocol fields, follow TCP conversations, calculate protocol statistics, and export structured data.
Do I need the Wireshark graphical application?
No. All analysis is performed with Tshark in the terminal. Tshark uses Wireshark’s protocol decoding engine, but the course does not require or teach the desktop GUI.
Does the challenge analyze live malware or contact a real C2 server?
No. It reads a prepared suspicious_traffic.pcap containing simulated DNS and HTTP evidence. The task does not execute malware or communicate with an external command-and-control system.
Will the course decrypt HTTPS or other encrypted sessions?
No. The exercises inspect decoded metadata and deliberately readable DNS and HTTP traffic. They do not provide session keys or teach TLS decryption, so encrypted application payloads remain outside the course scope.
