Wireshark Certified Analyst (WCA-101)

Network outages and suspected security events often stall when teams lack a shared packet-analysis process. This intermediate WCA-101 training helps IT Directors standardize how network, infrastructure, support, and security practitioners use Wireshark to capture traffic, manage trace files, apply filters, analyze core protocols, and troubleshoot at Layers 2–4. The course is a meaningful time investment: roughly 35.5 hours per learner, best assigned over several weeks with time to compare packet captures and align internal troubleshooting notes. For change management, Team Leads can use the course to establish common Wireshark profiles, filtering practices, and escalation language so packet evidence is easier to share across teams. CBT Nuggets Playlists can organize the course by role or rollout phase, and Team Reporting helps Training Managers track progress toward WCA-101 readiness.

IT teams complete this training to make packet captures more useful during real incidents, not just lab exercises. The course covers Wireshark file handling, object exports, capture and display filters, interface profiles, Ethernet and ARP analysis, IPv4/IPv6, ICMP, UDP, DHCP, DNS, TCP behavior, and troubleshooting graphs.

• Reduce troubleshooting time by using display filters, membership filters, operators, and custom views to isolate relevant traffic.
• Improve outage response by analyzing TCP handshakes, resets, acknowledgements, MSS, window scaling, and timing.
• Strengthen security investigations by recognizing Layer 2 attack patterns, ARP behavior, and abnormal Ethernet-frame activity.
• Build better network evidence by managing capture files, exporting objects, finding packets, and using I/O, flow, and TCP stream graphs for escalation.

Knowledge

• Wireshark file management, object export, packet search, profiles, and interface customization.
• Capture techniques, command-line operations, and capture/display filter logic.
• Ethernet frames, ARP behavior, Layer 2 attack indicators, and IPv4 header fields.
• IPv4 fragmentation, TTL, protocol fields, ICMPv4, and IPv6 packet analysis.
• UDP, DHCPv4, DNS, and TCP session behavior, including setup, teardown, resets, SACK, MSS, and window scaling.

Ability

• Capture and manage packet data in a repeatable way for troubleshooting and analysis.
• Build filters that narrow large captures to the traffic that matters.
• Interpret packet-level evidence across Ethernet, ARP, IP, ICMP, UDP, DNS, DHCP, and TCP.
• Use I/O graphs, flow graphs, and TCP stream graphs to visualize traffic patterns.
• Apply Wireshark findings to real troubleshooting workflows and WCA-101 certification preparation.