雲端及網路監聽技術 (WireShark 4.0) 課程
課程簡稱：WireShark Training Course (4.0)

WireShark 已被譽為偵察及防衛的必用軟件，正確地使用 WireShark 能夠及時發現網路效能及保安事故，並追蹤來源。

WireShark 軟件雲集全球頂尖網路技術及保安專家共同研發超過二十年，該軟件使用 GPL (General Public License) 授權，費用全免。

WireShark 可用於 Windows / Linux / Unix / macOS / FreeBSD 等多種平台，並可讀寫多種格式、多種來源的網路錄影檔 (Capture / Trace files) 如 tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer, Sniffer Pro, and NetXray, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek 等等。

另外，WireShark 支援市面上大部份網路介面，包括 Ethernet, IEEE 802.11 (Wifi), PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI。

理所當然地，今時今日的網路通訊大多數已被加密，WireShark 4.0 版可以解密以下的加密安全通訊協議，包括：IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2/WPA3，從而協助網路管理員進行疑難排解。

本課程將教授新版 WireShark 4.0 的功能、特色，以及於投產環境 (On-Premises) 及雲端 (On Cloud) 使用時須要注意的事項及技術！

學員將會使用本中心的電腦及器材進行適用於投產環境 (On-Premises) 的練習。

關於雲端的部份，本課程將以 Microsoft Azure 進行雲端相關的技術示範，學員可因應自身情況選擇 Microsoft Azure, Amazon AWS 或 Google Cloud Platform 等等不同品牌的雲端進行相關的測試。

1. Introduction to WireShark
1.1 What is WireShark?
1.1.1 Some Intended purposes of WireShark
1.1.2 Features of WireShark
1.1.3 Live Capture from many different network media
1.1.4 Import files from many other capture programs
1.1.5 Export files for many other capture programs
1.1.6 Many protocol dissectors
1.1.7 Open Source Software
1.1.8 What Wireshark is not
1.2 System Requirements
1.2.1 Reminders
1.2.2 Microsoft Windows
1.2.3 Unix / Linux
1.3 Where to get Wireshark?
1.4 A brief history of Wireshark
1.5 How WireShark Works
1.5.1 Capturing Traffic
1.5.2 Opening Trace Files
1.5.3 Processing Packets
1.6 WireShark Folders, Plugins and Help
1.7 Resources and References for Analysis
1.8 Data Flow Overview
1.8.1 Analyzer Placement for Hub’ed network
1.8.2 Analyzer Placement for Switched Network
1.8.3 Hub Out
1.8.4 Packet Loss Upstream
1.8.5 Hub Out at the Server or SPAN (Switched Port Analyzer)
1.8.6 Analyzer placement for Routed Networks
1.8.7 Full Duplex Link
1.8.8 Deciding whether to use a TAP or a SPAN/mirror port
1.8.9 Non-Aggregated Capture
1.8.10 Aggregated Capture

2. Capturing Packets
2.1 Select an Active Interface
2.2 Capture to Disk
2.3 Capture to a Ring Buffer
2.4 Open and Work with File Sets
2.5 Default Capture Filters
2.6 Creating New Capture Filters
2.7 Avoid Dropped Packets

3. Configuring Global Preferences
3.1 Customizing User Interface
3.2 Configuring Global Capture Preferences
3.3 Configuring Name Resolution Preference
3.4 Altering Protocol Settings

4. Navigation and Colorization Techniques
4.1 Locating a Specific Packet Number
4.2 Finding Packets based on Payload Values
4.3 Sorting Columns
4.4 Using and Customizing Packet Colors
4.5 Marking Packets
4.6 Opening Packet in a New Window

5. Examining Basic Trace File Statistics
5.1 Examining Protocol Hierarchies
5.2 Viewing Network Connections
5.3 Viewing Network Endpoints
5.4 Evaluating Destinations
5.5 Viewing IP Address Information
5.6 Evaluating Packet Lengths
5.7 Evaluating IP Protocol Types
5.8 Examining Multicast Streams and Settings

6. Advanced Trace File Statistics
6.1 Creating I/O Graphs
6.2 Creating TCP Time-Sequence Graphs
6.3 Analyzing Flow Graphs
6.4 Evaluating Service Response Times
6.5 Analyze BOOTP/DHCP Statistics
6.6 Viewing HTTP Statistics
6.7 Creating Round-Trip Time Graphs

7. Display Filters
7.1 Following TCP Stream
7.2 Creating Filters from Conversations and Endpoints
7.3 Default Display Filters and Filter Syntax
7.4 Building Filters based on Packets
7.5 Building Filters based on Payload Bytes
7.6 Using Expressions to Build Display Filters
7.7 Using Logical Operators
7.8 The Ten Most Useful Filters

8. TCP/IP Resources and References
8.1 The TCP/IP Resolution Process
8.1.1 Stealth
8.1.2 When everything goes right
8.1.3 The Scenario
8.2 Faults in the Resolution Process

9. Analyzing Domain Name System (DNS) Traffic
9.1 Analyzing Normal DNS Traffic
9.2 Abnormal DNS Traffic

10. Analyzing Address Resolution Protocol (ARP) Traffic
10.1 Analyzing Normal ARP Traffic
10.2 Analyzing Abnormal ARP Traffic

11. Analyzing Internet Protocol Version 4 Traffic
11.1 Analyzing Normal IPv4 Traffic
11.2 Analyzing Abnormal IPv4 Traffic

12. Offline Decryption
12.1 SSL/TLS Parsing

13. Using WireShark on Cloud
13.1 Capturing Virtual Networks in a Private Cloud environment
13.1.1 About Virtual Networks in Hyper-V
13.1.2 Virtual Switch Manager
13.1.3 Virtual Network Connection Type
13.1.4 External virtual networks
13.1.5 Internal virtual networks
13.1.6 Private virtual networks
13.1.7 Installing Hyper-V Role Service on Windows Server 2022
13.1.8 Creating a Virtual Machine and Installing a Guest OS
13.1.9 Configuring Hyper-V Port Mirroring
13.2 Layer 2 and Layer 3 considerations in VMWare Virtual Networking
13.2.1 Physical Networking in VMWare
13.2.2 Virtual Networking in VMWare Environemnt
13.2.3 The VMWare Standard Virtual Switch
13.2.4 MTU, Jumbo Frame Support in WireShark and VMWare Standard Virtual Swtich
13.2.5 Capturing with vSphere Distributed Switch

14. WireShark with Azure Network Watcher
14.1 Manage packet captures with Azure Network Watcher
14.1.1 Installing Network Watcher Agent Extension
14.1.2 Creating Connection Monitor
14.2 Finding and analyzing network anomalies with WireShark
14.3 Visualizing Cloud Network traffic