Wireshark Certified Analyst

Detailed Exam Objectives

The exam objectives were developed by a team of Wireshark developers, protocol experts, network and security engineers, and experienced educators, ensuring candidates demonstrate the real-world skills and knowledge used by professional network protocol analysts.

Download WCA-101 Exam Objectives PDF

• Utilize key features of Wireshark

  • Open, save, and close files, and export specified packets.
  • Describe the difference between different capture file formats, especially pcap and pcapng.
  • Export objects from packet captures.
  • Use 'Find Packet' to locate packets of interest.
  • Use the packet and file comments feature.
  • Set/Unset Gme reference.
  • Apply different Gme formats in a capture.
  • Describe how Wireshark applies different name resolution options. Configure name resolution.
  • Use 'Decode as' feature.
  • Use 'Capture File ProperGes' to identify key information about the capture.
  • Use 'Protocol Hierarchy' to identify key protocols in a capture.
  • Use 'Conversations' to identify key communications in a capture.
  • Use 'Endpoints' to analyze host traffic in a capture.
  • Create and interpret an I/O graph that shows packets/s or bits/s for a given display filter.
  • Distinguish between actual bytes captured and fields generated by the Wireshark dissectors. (shown in [ ])
  • Use 'Follow TCP/UDP' stream.

• Utilize different methods of Capturing Traffic

  • Compare and contrast the benefits of different methods used for traffic capture. (Direct on Endpoint, Network Tap, Infrastructure Device, Port Mirror, Multi-Point Capture)
  • Select the appropriate interface to capture traffic in Wireshark.
  • Start/Stop/Restart Capture in Wireshark.
  • Limit capture by file size, packets, or duration.
  • Implement a Ring Buffer.
  • Save a capture.
  • Export specified packets to a new file.
  • Capture traffic using command line tools.
  • Describe the purpose of using promiscuous or monitor mode during a capture

• Filter traffic using capture and display filters.

  • Compare and contrast Display Filters and Capture Filters.
  • Implement a Capture Filter to capture only traffic from a single protocol, IP address, MAC address, or port (range).
  • Use multiple methods to create a Display Filter to isolate traffic for a single protocol or a property of a protocol. (manual entry, right click, drag/drop)
  • Use membership filters (tcp.port in {80,443} )
  • Use logical operators to connect multiple filters together.
  • Create a button for easy access to a Display Filter.
  • Identify situations where a Display Filter will show incomplete or excess results (i.e. filter
  for HTTP, but do not see the TCP handshake)
  • Identify the behavior of using ! (not) in different parts of filter logic by explaining the
  implicit 'any' and 'all' qualifiers.
  • Apply filters from Statistics > Conversations and Statistics > Endpoints.
  • Create a filter using generated fields in Wireshark.

• Configure, adapt, and use the Wireshark interface for different scenarios.

  • Identify key components of the GUI (packet list, hex view, packet details, etc.).
  • Modify panes with a different layout/features.
  • Describe the value of using profiles.
  • Create/modify/copy a profile.
  • Describe the importance of columns in troubleshooting.
  • Use multiple methods to add a column.
  • Use coloring rules to highlight packets.
  • Use the minimap (colored sidebar) to quickly locate packets of interest.
  • Use the 'Colorize Conversation' feature.
  • Understand the importance of protocol preferences in your analysis.
  • Use the mark/unmark packet feature.

• Identify and explain common network protocols

  • ETHERNET, ARP, IPv4, ICMPv4, IPv6, ICMPv6, UDP, DHCPv4, DNS, TCP

• Use Wireshark to troubleshoot common issues with protocols

  • Determine network topology only using information in a packet capture.
  • Perform TCP sequence and acknowledgment number analysis.
  • Distinguish server performance from slow transfer Gmes (for instance in HTTP).
  • Identify the effect of high RTT on request/response protocols. (For example: HTTP, SMB, SQL)
  • Identify the effect of a low window size in combination with high RTT.
  • Given a capture, identify potential network communication issues using information from ARP, DHCP, and ICMP.

Wireshark Certified Analyst Training

Ready to get certified? The Wireshark Foundation partners with talented engineers and educators to provide high quality training for the certification exam. Whether you prefer self-paced learning or instructor-led courses, you'll find the perfect training options to fit your needs