WCNA

The Wireshark Certified Network Analyst (WCNA) exam focuses on practical skills and knowledge related to network analysis using Wireshark. The main points covered can be grouped into these key areas:

1. Wireshark Interface and Basic Operation:

• Capturing packets: Understanding different capture interfaces, options (promisc mode, filters), and limitations.
• Navigating the interface: Familiarity with the main panels (Packet List, Packet Details, Packet Bytes), and their functionalities.
• Basic packet filtering: Applying display filters to isolate specific traffic based on protocols, ports, IPs, etc.
• Saving and managing captures: Knowing how to save captures in different formats (.pcap, .pcapng) and manage large files.

2. Understanding Network Protocols:

• Ethernet: Frame structure, addressing, VLAN tagging.
• IPv4 and IPv6: Header fields, addressing, fragmentation, options.
• TCP and UDP: Header fields, connection establishment and termination, port numbers, error handling.
• ICMP: Types of ICMP messages and their use in troubleshooting.
• ARP and DHCP: Processes, message types, and troubleshooting.
• Other common protocols: HTTP, HTTPS, DNS, SMTP, FTP, etc. Understanding their basic functions and header characteristics.

3. Network Analysis Techniques:

• Protocol analysis: Deciphering the information within packet headers and payloads to understand network traffic flow.
• Tracing conversations: Identifying and following TCP or UDP conversations across multiple packets.
• Timelining events: Analyzing packet timestamps to understand the sequence of events.
• Identifying network problems: Using Wireshark to diagnose common networking issues like connectivity problems, routing issues, and slow performance.
• Security analysis: Identifying potential security threats such as malware, unauthorized access attempts, and vulnerabilities.

4. Advanced Wireshark Features:

• Follow TCP Stream: Reconstructing application-level data from TCP conversations.
• Expert Information: Interpreting Wireshark's warnings and errors to identify potential problems.
• Statistics: Generating statistics on network traffic.
• VoIP Analysis: Analyzing VoIP calls.
• Wireless Analysis (802.11): (Depending on the specific exam version) Understanding Wi-Fi frames and their structure.

In essence, the WCNA exam tests your ability to use Wireshark effectively to capture, analyze, and interpret network traffic. It's less about rote memorization of protocol details and more about practical application and problem-solving using the tool. You'll be presented with capture files and asked to analyze them to answer questions related to network traffic characteristics, protocol behaviors, and potential issues. Thorough practice using Wireshark with diverse sample captures is crucial for success.