Experience SharkFest

SharkFest attendees hone their skills in the art of packet analysis by attending lecture and lab-based sessions delivered by the most seasoned experts in the industry. Wireshark core code contributors also gather during the conference days to enrich and evolve the tool to maintain its relevance in ensuring the productivity of modern networks.

This hands-on course will provide core Wireshark skills for IT pros of all experience levels. Participants will gain a solid understanding of how to use Wireshark to capture, analyze, and troubleshoot network traffic. The course is designed with beginners in mind, but even seasoned packet people will pick up new tips and tricks. Topics covered include: an introduction to network analysis and the role of Wireshark, installing and configuring Wireshark, analyzing captured packets, understanding protocol structures, and identifying network issues, utilizing powerful filtering techniques to isolate specific traffic and find the packets that matter, a deep Dive into ARP, IP, ICMP, DNS, DHCP, TCP, UDP, QUIC, HTTP, TLS, and working with command-line tools like TShark.

Analyzing TCP connections is one of the biggest topics in network analysis in general, especially when troubleshooting applications or even multi-tiered deployments of servers. How TCP works and detecting problems is one of the 'easy to learn, hard to master' skills that is always in demand. Most Wireshark classes only touch the basics and do not go into the more complex scenarios, especially when it comes to multi point captures to track packet loss and timing issues. In this masterclass you will learn how to troubleshoot TCP in seemingly simple as well as complex and quite challenging cases.

SMB is the bread and butter protocol used to access file shares in virtually every company and home network. Since Windows Vista / Server 2008, the "classic" SMB has been replaced by SMB2 and later SMB3. Since legacy systems running Windows XP / Server 2003 are increasingly rare, we focus on the newer version.

This class will enable students to investigate functional issues and performance problems. Topics covered are

• SMB Handshake, selection of a dialect version and user authentication
• General process of mounting a share and accessing files
• Tracking SMB sessions over multiple interfaces or IP-addresses
• SMB functions beyond file sharing (IPC, Named Pipes)
• Investigating error codes
• Decryption of SMB traffic (not for the faint-hearted)
• Understanding the service response time feature for SMB
• identification of performance bottlenecks in the network, application logic, client or server