Analyse Network Traffic using Wireshark to Detect Anomalies and Intrusions

Learning Objectives

At the end of this topic, you will be able to:

1. Install and configure Wireshark on the appropriate network interface.
2. Capture network traffic using correct capture filters.
3. Inspect and interpret packets across protocol layers.
4. Apply display filters and colouring rules to isolate suspicious traffic.
5. Identify traffic anomalies such as port scans, ARP spoofing, and abnormal volumes.
6. Document intrusion indicators and recommend mitigation actions.