By completing this workshop, participants will develop practical skills to analyze encrypted network traffic and PCAP files using Wireshark, even when the contents of network communications cannot be directly viewed.

Imparerai a:

Configure Wireshark for Encrypted Traffic Analysis

• Configure Wireshark for efficient encrypted traffic investigations.
• Use specialized Wireshark profiles to organize and accelerate analysis.
• Configure relevant views, fields, statistics, and analysis tools.
• Apply an efficient workflow when investigating large or complex PCAP files.

Understand Network Encryption

• Understand the fundamentals of SSL/TLS and HTTPS.
• Understand the principles of wireless encryption, including WEP, WPA, WPA2, and WPA3.
• Identify where encryption is applied within network communications.
• Determine which information remains observable when traffic is encrypted.

Analyze Encrypted Network Traffic

• Identify encrypted communications within a PCAP file.
• Analyze endpoints, protocols, ports, packet sizes, timing, and communication patterns.
• Examine TLS connections and relevant protocol fields.
• Identify communication relationships between systems and services.
• Use packet-level information to understand encrypted network behavior without relying solely on payload contents.

Investigate Encrypted Traffic with Wireshark

• Create effective Wireshark display filters for encrypted traffic.
• Isolate relevant hosts, conversations, protocols, and network events.
• Follow network conversations and analyze communication flows.
• Use Wireshark statistics to identify significant traffic patterns.
• Reconstruct and visualize network communications where possible.

Identify Suspicious Network Behavior

• Establish a baseline for normal encrypted communication.
• Identify unusual data flows and unexpected communication patterns.
• Riconoscere gli indicatori che potrebbero richiedere ulteriori indagini di sicurezza.
• Analyze encrypted traffic as part of threat hunting and network security investigations.
• Use PCAP evidence to support network and forensic investigations.

Apply Real-World Analysis Techniques

• Work with realistic encrypted PCAP files and practical investigation scenarios.
• Apply a structured methodology to encrypted traffic analysis.
• Combine protocol analysis, Wireshark statistics, filtering, and traffic visualization.
• Traduci le osservazioni a livello di pacchetto in conclusioni tecniche significative.

Risultato pratico

After completing the workshop, participants will be able to approach an encrypted PCAP systematically, identify relevant communications, analyze observable characteristics of encrypted traffic, recognize unusual behavior, and use Wireshark to determine what can be learned from encrypted network activity.

Queste competenze forniscono una base pratica per il lavoro professionale in encrypted traffic analysis, network troubleshooting, cybersecurity, threat hunting, incident response, and network forensics.