Free Online Course · Self-paced · Hands-on

Wireshark Tutorial for Network Analysis & Troubleshooting

Free, hands-on Wireshark course covering packet capture, display filters, TCP analysis, TLS and IPsec decryption, and network troubleshooting.

  • 10 chapters
  • 43 lessons
  • ~8h 18m
  • Beginner to Advanced
  • Tested with Wireshark 4.4.x
  • Updated Oct 2026
Start the course View syllabus
Wireshark Tutorial for Network Analysis & Troubleshooting
By Last updated

About this course

This is a free, hands-on course in reading network traffic with Wireshark, the most widely used packet analyzer. It takes you from your first capture to decrypting TLS and QUIC sessions and writing custom dissectors, with worked examples for the protocols you actually meet: DNS, HTTP, QUIC/HTTP/3, TCP, TLS, VLAN, ARP, IPsec, Kerberos, LDAPS, and RADIUS/NPS AAA flows.

The focus is on evidence over guesswork. Each lesson shows what to capture, which display filter isolates the problem, and how to read the result, so you can answer "what is happening on this network?" from the packets instead of a hunch. Wireshark is free and open source under the GPL, runs on Windows, macOS, and Linux, and pairs with tcpdump for capture on headless servers.

If you are starting out, begin with how to use Wireshark and the IP filter cheat sheet, then work into TCP internals. If you are troubleshooting something specific right now, jump to DNS, TCP connection failures, QUIC and HTTP/3, or TLS decryption.

What you'll learn

  • Capture, filter, and analyze packets across DNS, HTTP, QUIC/HTTP/3, TCP, TLS, ARP, VLAN, LDAP, Kerberos, and IPsec
  • Split capture filters from display filters and build reusable configuration profiles
  • Read TCP internals: sequence and acknowledgement numbers, connection failures, windows, retransmissions, and capture gaps
  • Decrypt SSL/TLS, LDAPS, and IPsec traffic for legitimate troubleshooting
  • Diagnose real faults: retransmissions, zero-window, fragmentation, rogue DHCP, duplicate ARP, and DNS failures
  • Use Wireshark for security work, from malicious resource detection to log4j-style analysis
  • Capture from remote hosts and extend Wireshark with a custom dissector
  • Read RADIUS and NPS Access-Request/Accept flows alongside NPS, FreeRADIUS, and Cisco AAA lab setups

Who this course is for

  • Network engineers troubleshooting slow links, drops, and failed handshakes
  • Security analysts inspecting suspicious traffic and decrypting sessions for review
  • SREs and sysadmins who need packet-level evidence, not guesses
  • Students learning how TCP, TLS, DNS, and the rest actually behave on the wire

Prerequisites

  • A workstation with Wireshark installed (Linux, macOS, or Windows)
  • Basic networking knowledge - TCP/IP, OSI layers, what an IP address is
  • Root/admin privileges to capture from network interfaces

Versions and testing environment

Every command in this course was run on this stack

ComponentVersionNotes
Wireshark 4.4.x GUI capture, display filters, and protocol analysis
TShark 4.4.x Command-line capture and analysis
tcpdump 4.99.x Lightweight CLI capture that feeds Wireshark
Kali Linux Rolling 2026.2 Capture host used in the sniffing walkthrough

Syllabus

10 chapters · 43 lessons · ~8h 18m of reading

  1. 1 Getting Started with Wireshark 3 lessons · ~38 min
    1. Part 1 Network sniffing with Wireshark and tcpdump 14 min read
    2. Part 2 Create reusable configuration profiles 15 min read
    3. Part 3 Wireshark IP filter cheat sheet 9 min read
  2. 2 TCP Deep Dive 8 lessons · ~1h 31m
    1. Part 4 TCP sequence and acknowledgement numbers explained 15 min read
    2. Part 5 TCP receive window explained 5 min read
    3. Part 6 Diagnose TCP zero-window with Wireshark 6 min read
    4. Part 7 TCP retransmissions - causes and analysis 7 min read
    5. Part 8 TCP connection failures - SYN timeout vs RST 11 min read
    6. Part 9 TCP previous segment not captured 13 min read
    7. Part 10 Packet fragmentation in Wireshark 23 min read
    8. Part 11 Troubleshooting with TTL values 11 min read
  3. 3 DNS, HTTP, ARP and L2 8 lessons · ~1h 26m
    1. Part 12 DNS troubleshooting in Wireshark 13 min read
    2. Part 13 Analyze HTTP response in Wireshark 14 min read
    3. Part 14 Detect a rogue DHCP server 16 min read
    4. Part 15 Find duplicate IPs with ARP analysis 7 min read
    5. Part 16 Analyze 802.1Q VLAN tags 11 min read
    6. Part 17 Trace IP addresses across captures 5 min read
    7. Part 18 Discover network loops with Wireshark 13 min read
    8. Part 19 VRRP with Keepalived and Cisco (packet analysis) 7 min read
  4. 4 QUIC and HTTP/3 1 lesson · ~9 min
    1. Part 20 Analyze QUIC and HTTP/3 traffic 9 min read
  5. 5 TLS / SSL Decryption and Analysis 7 lessons · ~1h 25m
    1. Part 21 Decrypt SSL/TLS traffic in Wireshark 6 min read
    2. Part 22 Troubleshoot TLS handshake failures 10 min read
    3. Part 23 Analyze TLS / mTLS sessions 17 min read
    4. Part 24 Decrypt HTTPS / LDAPS traffic 12 min read
    5. Part 25 Analyze LDAP traffic 13 min read
    6. Part 26 Kerberos authentication packet analysis 16 min read
    7. Part 27 Decrypt RDP traffic (with Frida) 11 min read
  6. 6 RADIUS, NPS and AAA 6 lessons · ~1h 37m
    1. Part 28 Install and configure Windows NPS 22 min read
    2. Part 29 Cisco AAA with Windows NPS 11 min read
    3. Part 30 PEAP MS-CHAPv2 with NPS 6 min read
    4. Part 31 FreeRADIUS PAP and CHAP authentication 21 min read
    5. Part 32 FreeRADIUS LDAP authentication and group authorization 16 min read
    6. Part 33 FreeRADIUS with Active Directory (Winbind) 21 min read
  7. 7 IPsec / VPN Analysis 2 lessons · ~12 min
    1. Part 34 Analyze IPsec traffic 6 min read
    2. Part 35 Decrypt IPsec ISAKMP and ESP packets 6 min read
  8. 8 Performance and Remote Capture 4 lessons · ~43 min
    1. Part 36 Measure bandwidth with Wireshark 11 min read
    2. Part 37 Check if your ISP is blocking a website 7 min read
    3. Part 38 Troubleshoot TFTP issues 7 min read
    4. Part 39 Wireshark remote packet capture 18 min read
  9. 9 Security and Threat Analysis 3 lessons · ~30 min
    1. Part 40 Detect malicious resources in captures 6 min read
    2. Part 41 Analyze the log4j2 vulnerability with Wireshark 15 min read
    3. Part 42 Edit packets in Wireshark (for testing) 9 min read
  10. 10 Advanced Wireshark 1 lesson · ~7 min
    1. Part 43 Write a custom Wireshark dissector 7 min read

Hands-on labs

8 guided builds you run yourself

  1. Capture and read your first packets

    Pick an interface, take a short capture, and split capture filters from display filters to find the traffic that matters.

  2. Decrypt TLS with a session key log

    Point Wireshark at an SSLKEYLOGFILE and read HTTPS payloads that were unreadable a moment before.

  3. Diagnose TCP retransmissions

    Measure round-trip time, spot retransmission timeouts and fast retransmits, and filter them out of a busy capture.

  4. Find a rogue DHCP server

    Follow the DHCP message types to identify an unexpected server handing out leases.

  5. Capture packets from a remote host

    Pull a live capture off a Windows or Linux box you cannot sit in front of.

  6. Troubleshoot DNS in Wireshark

    Follow queries and responses, spot slow or failing lookups, and filter on DNS RCODE.

  7. Analyze QUIC and HTTP/3

    Filter QUIC long headers, load a TLS key log, and read HTTP/3 streams after decryption.

  8. Write a custom Wireshark dissector

    Teach Wireshark to decode your own protocol so its fields show up in the detail pane.

Where to go after this course

Frequently Asked Questions

Is Wireshark free?

Yes. Wireshark is free and open source under the GNU GPL version 2. There is no paid tier, trial, or feature lock, and that includes the command-line tools TShark and tcpdump-style capture. Download it from wireshark.org for Windows, macOS, or Linux.

Wireshark itself is legal: it is a diagnostic tool, not an attack. What matters is whose traffic you capture. Only capture on networks and devices you own or are explicitly authorized to monitor, because intercepting other people's communications without consent can break the law where you live. In a workplace, get written permission before you start a capture.

Wireshark or tcpdump, which should I use?

Use both. tcpdump is lightweight and command-line, so it is ideal for quick captures on remote or headless servers where a GUI is not available. Wireshark gives you deep protocol decoding and a graphical view for analysis. A common workflow is to capture with tcpdump -w file.pcap on the server, copy the file to your workstation, and open it in Wireshark.

Do I need admin or root rights to capture?

Yes, to capture live from a network interface you need administrator rights on Windows or root (or the right group membership) on Linux and macOS. You do not need elevated rights to open and analyze a saved .pcap file, so you can hand captures to someone else for review.

Can Wireshark decrypt HTTPS or TLS traffic?

Only when you supply the keys. Wireshark cannot break encryption. It can decrypt a session if you give it the pre-master secrets through an SSLKEYLOGFILE, or the server's private key for older RSA key exchange. Without one of those, encrypted payloads stay unreadable and you only see the TLS handshake. The TLS decryption lesson walks through the session-key method.

Deepak Prasad

R&D Engineer

Founder of GoLinuxCloud with 15+ years of expertise in Linux, Python, Go, Laravel, DevOps, Kubernetes, Git, Shell scripting, OpenShift, AWS, Networking, and Security. With extensive experience, he excels across development, DevOps, networking, and security, delivering robust and efficient solutions for diverse projects.

Expertise
  • Go (programming language)
  • Python (programming language)
  • DevOps
  • Computer Security
  • Cloud Computing
  • Kubernetes
  • Linux
  • Ansible (software)