This training will focus on using Wireshark to spot potentially malicious traffic on your network. No prior knowledge of Wireshark is required but some basic familiarity with network protocols is assumed. We will start with a brief introduction to Wireshark, its capabilities and uses. Next, we will discuss where and how to monitor your network with Wireshark and what factors affect those decisions. At this point we are now ready to start applying capture filters, display filters, and custom colorization rules to highlight the information we are interested in seeing. We will then discuss different network attack techniques including host discovery, port scanning, OS fingerprinting, ARP spoofing and IP spoofing. We will practice spotting these techniques in our network captures. The entire workshop will be very hands on with many different sample captures to work from as we identify both normal and abnormal traffic. We will not be doing any live captures. Introduction (5 min) Where and How to sniff (including decryption techniques) (30 min) Capture and Display Filters (15 min) Colorization Rules (15 min) Host discovery techniques (15 min) Port scanning (30 min) OS fingerprinting (15 min) ARP/IP spoofing (20 min) Malware/tool specific signatures (25 min) Putting it all together (30 min)