Wireshark for Network Analysis: Advanced Techniques for Engineers

Advanced packet analysis with Wireshark: display filters, dissectors, TLS decryption, I/O graphs, TCP stream tracking, and Expert Info. Advanced techniques for senior network engineers: troubleshooting VoIP, BGP, TLS handshakes, and retransmissions. 2026 guide.

Display filters (essential)

• ip.addr == 10.0.0.5
• tcp.port == 443
• http.request.method == POST
• dns.qry.name contains google
• tcp.flags.syn == 1 && tcp.flags.ack == 0 (SYN only)
• tcp.analysis.retransmission
• !arp && !icmp (exclusions)

TCP analysis

• Follow TCP Stream: reconstructs the complete session
• TCP Conversations: top talkers by conversation
• Round Trip Time (RTT): actual latency
• Zero Window: receiver buffer is full
• Retransmissions: packet loss indicator

VoIP analysis

• Telephony → VoIP Calls: list of detected calls
• RTP Stream Analysis: jitter, loss, and MOS score
• SIP Flow: signaling trace
• Filter: rtp or sip

TLS/SSL analysis

• Handshake: ClientHello → ServerHello → Certificates → ChangeCipherSpec
• The TLS version can be identified in ClientHello
• SNI (Server Name Indication): the host remains visible even with TLS
• TLS Decryption: import session keys (SSLKEYLOGFILE)

BGP analysis

• Filter: bgp
• OPEN: session negotiation
• UPDATE: route advertisements
• KEEPALIVE: heartbeat
• NOTIFICATION: error + shutdown

Expert Info

• Analyze → Expert Info
• Automatically detects warnings, errors, and chats
• Retransmissions, duplicate ACKs, and out-of-order packets

I/O graphs

• Statistics → I/O Graph
• Visualizes traffic over time
• Color-coded filters (TCP, UDP, retransmissions)

Order from OPTINOC

Advanced Wireshark training and analysis of customer packet captures. Investigation support. Quote within 48 hours.