By completing this workshop, participants will develop practical skills to analyze encrypted network traffic and PCAP files using Wireshark, even when the contents of network communications cannot be directly viewed.

You will learn how to:

Configure Wireshark for Encrypted Traffic Analysis

• Configure Wireshark for efficient encrypted traffic investigations.
• Use specialized Wireshark profiles to organize and accelerate analysis.
• Configure relevant views, fields, statistics, and analysis tools.
• Apply an efficient workflow when investigating large or complex PCAP files.

Understand Network Encryption

• Understand the fundamentals of SSL/TLS and HTTPS.
• Understand the principles of wireless encryption, including WEP, WPA, WPA2, and WPA3.
• Identify where encryption is applied within network communications.
• Determine which information remains observable when traffic is encrypted.

Analyze Encrypted Network Traffic

• Identify encrypted communications within a PCAP file.
• Analyze endpoints, protocols, ports, packet sizes, timing, and communication patterns.
• Examine TLS connections and relevant protocol fields.
• Identify communication relationships between systems and services.
• Use packet-level information to understand encrypted network behavior without relying solely on payload contents.

Investigate Encrypted Traffic with Wireshark

• Create effective Wireshark display filters for encrypted traffic.
• Isolate relevant hosts, conversations, protocols, and network events.
• Follow network conversations and analyze communication flows.
• Use Wireshark statistics to identify significant traffic patterns.
• Reconstruct and visualize network communications where possible.

Identify Suspicious Network Behavior

• Establish a baseline for normal encrypted communication.
• Identify unusual data flows and unexpected communication patterns.
• Recognize indicators that may require further security investigation.
• Analyze encrypted traffic as part of threat hunting and network security investigations.
• Use PCAP evidence to support network and forensic investigations.

Apply Real-World Analysis Techniques

• Work with realistic encrypted PCAP files and practical investigation scenarios.
• Apply a structured methodology to encrypted traffic analysis.
• Combine protocol analysis, Wireshark statistics, filtering, and traffic visualization.
• Translate packet-level observations into meaningful technical conclusions.

Practical Outcome

After completing the workshop, participants will be able to approach an encrypted PCAP systematically, identify relevant communications, analyze observable characteristics of encrypted traffic, recognize unusual behavior, and use Wireshark to determine what can be learned from encrypted network activity.

These skills provide a practical foundation for professional work in encrypted traffic analysis, network troubleshooting, cybersecurity, threat hunting, incident response, and network forensics.