Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Wireshark
Exam Format
Registration
Validity
Skills this practice test covers
- Compare capture points such as a network tap, a port mirror and direct capture on the endpoint.
- Write capture filters in BPF syntax and display filters with membership sets and logical operators.
- Explain why a display filter that uses the not operator can return incomplete or excess results.
- Read Ethernet, ARP, IPv4, IPv6, DHCP and DNS fields in the packet details pane.
- Trace a TCP session through the handshake, sequence numbers, SACK blocks and teardown.
- Decide whether a slow response comes from the server, a high round trip time or a small TCP window.
Explore related topics
WCA-101 exam content
6 domains · 25 topics · 42 of 126 questions sorted by domain
Utilize Key Features of Wireshark10%15 questions
This domain covers the everyday tools inside Wireshark. Candidates open, save and export files, search and comment packets, set time references and name resolution, and read statistics windows such as Protocol Hierarchy and Conversations.
Skills tested
- Explain the difference between pcap and pcapng, and export specified packets or objects.
- Locate packets with Find Packet, and add packet and file comments.
- Set a time reference and switch time formats to measure gaps between packets.
- Use Decode As, Capture File Properties, Protocol Hierarchy, Conversations and I/O Graphs.
- Tell real captured bytes from fields that the dissectors generate, shown in square brackets.
Questions by topic
- File Operations and Export6
- Find Packet and Time Management6
- Statistical Analysis Tools3
Utilize Different Methods of Capturing Traffic10%12 questions
Good analysis starts with a good capture. This domain compares capture points such as a tap or a port mirror, and covers capture limits, ring buffers, command line capture, and promiscuous or monitor mode.
Skills tested
- Compare direct endpoint capture, a network tap, an infrastructure device and a port mirror.
- Limit a capture by file size, packet count or duration, and set up a ring buffer.
- Capture from the command line with dumpcap or tshark.
- Explain when promiscuous mode or monitor mode is needed.
Questions by topic
- Capture Methods Comparison5
- Capture Management and CLI Tools7
Filter Traffic Using Capture and Display Filters12%15 questions
This domain separates the two filter types. Candidates write capture filters that limit what is recorded and display filters that limit what is shown, then spot filters that return too much or too little.
Skills tested
- Write a capture filter that keeps one protocol, IP address, MAC address or port range.
- Build display filters by typing, by right-clicking a field, or by dragging it to the filter bar.
- Combine filters with logical operators and with membership sets of values.
- Explain how the not operator behaves with Wireshark's implicit any and all qualifiers.
- Apply filters from the Conversations and Endpoints windows and from generated fields.
Questions by topic
- Capture Filters vs Display Filters3
- Advanced Filter Concepts7
- Display Filter Creation and Logic5
Configure, Adapt, and Use the Wireshark Interface for Different Scenarios5%
The smallest domain is about shaping Wireshark to the task. Candidates change the pane layout, build profiles, add columns, and set coloring rules that make problem packets stand out.
Skills tested
- Name the packet list, packet details and hex view panes, and change the layout.
- Create, modify and copy a profile for one kind of analysis.
- Add columns in more than one way, and explain why columns speed up troubleshooting.
- Use coloring rules and the minimap to find packets of interest.
- Adjust protocol preferences that change how a dissector reads traffic.
Official topics
- GUI Components and Layout
- Profiles
- Columns and Coloring
- Protocol Preferences
Identify and Explain Common Network Protocols Dissected by Wireshark43%
The largest domain asks what each protocol field means in a capture. It runs from Ethernet frames, ARP and IPv4 to ICMPv6 neighbor discovery, DHCP and DNS. It also includes TCP, which is scored separately.
Skills tested
- Explain why the Ethernet CRC is missing in Wireshark, and name common EtherTypes.
- Tell broadcast ARP from unicast ARP, and filter each type of ARP packet.
- Read IPv4 header values such as TTL, fragmentation and IP ID, and explain how NAT affects a capture.
- Follow the four DHCP phases and read options such as router and DNS server.
- Explain the TCP handshake, teardown, iRTT, MSS and options such as SACK and window scaling.
Official topics
- Ethernet
- ARP
- IPv4
- ICMPv4
- IPv6
- ICMPv6
- UDP
- DHCPv4
- DNS
- TCP (Scored Separately - 17% of exam)
Use Wireshark to Troubleshoot Common Issues with Protocols20%
This domain turns protocol knowledge into diagnosis. Candidates infer the network topology from a capture, analyze TCP sequence and acknowledgment numbers, and tell a slow server from a slow network.
Skills tested
- Infer the network topology using only the information in a packet capture.
- Show how a high round trip time slows request and response protocols such as HTTP, SMB and SQL.
- Explain why a low window size combined with a high round trip time limits throughput.
- Use ARP, DHCP and ICMP packets to find communication problems.
Official topics
- Network Topology Inference
- TCP Performance Analysis
- Protocol-Based Issue Identification
Requirements
- No formal prerequisites: anyone can book the exam.
- Recommended: regular hands-on use of Wireshark and a solid grasp of TCP/IP networking.
- Recommended: experience troubleshooting networks that run Ethernet, IP, TCP, UDP, DNS and DHCP.
About the WCA-101 exam
WCA-101 is the Wireshark Foundation's exam for professional packet analysis with Wireshark. Network, security operations and IT operations staff take it to show they can capture and filter traffic, read what each protocol field means, and troubleshoot from the result. Its largest domain covers how common protocols look in Wireshark's dissectors, from Ethernet and ARP to DNS. TCP is scored as a section of its own. Passing earns the Wireshark Certified Analyst (WCA) certification, valid for three years.
Protocols and troubleshooting take up most of the PlanetCert practice test, with a separate set of TCP questions. The explanations work from packet fields: which flags tear a session down, why a DUP ACK appears, or which ARP packet type a capture shows. Study Mode suits the filter domain, where one character can change the result. Brainy AI Assistant can explain the implicit any and all qualifiers behind a not filter, or walk through a slow HTTP transfer packet by packet.
How to earn the certification
- Earns
- Wireshark Certified Analyst (WCA)Professional
The certification is valid for three years, and holders renew it by passing the exam again.
How to prepare for WCA-101
- 1
Capture real traffic every day
Run Wireshark on a home or lab network and save each capture as pcapng with comments. Repeat one capture with dumpcap from the command line, using a ring buffer.
- 2
Drill the two filter languages
Write a capture filter in BPF syntax and a display filter for the same goal, then compare the results. Test filters that use the not operator, and explain each result with the implicit any and all qualifiers.
- 3
Annotate one full TCP session
Pick one HTTP download and mark the handshake, the iRTT, the MSS, every SACK block and the teardown. TCP is scored as its own section, so it deserves its own study time.
- 4
Slow a lab link on purpose
Add delay to a lab link and compare transfers with a small and a large TCP window. The troubleshooting domain asks this kind of question for protocols such as HTTP, SMB and SQL.
- 5
End with timed WCA-101 runs
Take the WCA-101 practice test in Timed Mode once every domain feels steady. Ask Brainy AI Assistant about any protocol field in a missed question, then find that field in a real capture.
Start a timed WCA-101run
The Wireshark Foundation names official training partners for the exam, among them Packet Pioneer, Network Nerd, SCOS and SYN-bit.
Who WCA-101 is for
- Network and IT operations engineers who solve performance problems from packet captures.
- SOC analysts, incident responders and penetration testers who read traffic for evidence.
- Developers who need to see how their applications behave on the network.
Typical job titles: Network engineer · SOC analyst · Incident responder · Network architect · Penetration tester · IT operations engineer
WCA-101 glossary
19 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- APIPA
- Automatic Private IP Addressing: a 169.254.x.x address that a host gives itself when no DHCP server answers.
- Bandwidth-delay product
- Bandwidth multiplied by round trip time: the data that must be in flight to fill a link, which a small TCP window cannot reach.
- BPF syntax
- The Berkeley Packet Filter syntax used by capture filters, with expressions such as host, net and port.
- Capture Filter
- A filter set before a capture starts, so that only matching packets are saved.
- Decode As
- A feature that tells Wireshark to dissect traffic on a port as a chosen protocol, such as a service on a non-standard port.
- Display Filter
- A filter applied to captured packets that hides the ones not needed, without deleting them, written in Wireshark's field syntax.
- dumpcap
- Wireshark's command-line capture engine, which writes packets to a file without dissecting them.
- Duplicate ACK (DUP ACK)
- A repeated acknowledgment of the same sequence number, a sign that a segment is missing.
- I/O Graphs
- Charts of packets or bits per second over time, which can show only the traffic that matches a display filter.
- Initial Round Trip Time (iRTT)
- The round trip time Wireshark measures from the TCP three-way handshake, a baseline for the connection's latency.
- Maximum Segment Size (MSS)
- The largest TCP payload a host will accept in one segment, announced during the handshake.
- Monitor mode
- A Wi-Fi interface setting that captures 802.11 frames on a channel without joining a network.
- pcapng
- The newer capture file format, which can store comments, several interfaces and extra metadata that plain pcap cannot.
- Port Mirror
- A switch feature that copies traffic from chosen ports to another port, where Wireshark can capture it.
- Promiscuous mode
- An interface setting that captures every frame on the segment, not only frames addressed to the capturing host.
- Protocol Hierarchy
- A statistics window that lists the protocols in a capture and the share of traffic each one carries.
- Ring Buffer
- A capture setting that writes to a fixed set of files and overwrites the oldest, so a long capture does not fill the disk.
- Selective Acknowledgment (SACK)
- A TCP option that lets the receiver acknowledge data that arrived after a gap, so only the missing segments are sent again.
- tshark
- The command-line version of Wireshark, which can capture, dissect and filter packets in a terminal.