In this module we will be discussing
capturing packets.
So, one of the interesting things about capturing packets is that
up until now, everything we learned we have moved into, you know,
where do we put Wireshark? What do we do with it?
How do we capture the, the traffic and, and specifically, what does that really mean?
So. in this example, I think what we should do here is take a moment
just to quickly show what it is that we're actually talking about when we say capturing data.
So what I'm going to do here is, if you could see it on the screen -
I am going to select an interface, and for this one, I think I am going to
select my wireless interface and I am going to run
and start a catpure.
So, this is essentially, what this whole next module
is really going to focus on is that
we want to understand how to get to this level of Wireshark.
How we're actually capturing this data? What are we capturing?
So as we discussed with capturing up until now,
do these things that we can set up,
we could move into adjusting it.
While With wireshark, we are capturing the data
to review and analyze, and we need to place this correctly.
We need to understand what it is that we're looking for.
At least, in essence, to be able to place it correctly.
We need to have a little bit of an understanding of what it is that we're trying to troubleshoot
so we know when to run the capture.
We need to know if there's going to be things that we want to adjust prior to.
So that we can eliminate some of the things that we're going to see.
We want to consider what protocols we're going to be involved in using
and we're going to be considering the traffic patterns from source to destination.
Just to reflect back on where we're troubleshooting
from and to in our simple network diagram -
we are a network - the source, the network client, the host.
We are trying to access something on the server.
And we have Wireshark configured so that we can capture that communication.
So as we just observed, we want to open up Wireshark.
It's been installed. It's pre-configured.
Everything is set. I have my profile ready.
I have my basic preferences set.
I know what interface I want to depict.
And I know exactly what it is that I am trying to capture in this particular case.
I wanted to see what was on the wireless network.
I selected the wireless adaptor.
I had some pre-configuration options already set up.
And I then launch my capture.
And then once I was done, I was shown a handful of data on this network.
And this is not from a pre-captured filter,
this is just all the data that was available at the time.
And as we see, it captured everything from when I started to when I stopped.
As we mentioned, we captured data. We selected the correct interface.
In this, unfortunately in this graphic, it's set to LAN.
For the example I showed, it was set, set to wireless LAN, but again
that is exactly the point. You want to know what interface to pick.
And what it is that you need to see.
You want to start the capture. And you want to stop the capture.
And you want to save the capture. So, and particularly, and we'll get to this,
when we get into this on module 4, at the end, on day 3, but
you want to basically save the data, and here, I could just say, sample capture.
And I have my caption.
If you want to capture data, you can use the capture window.
Here, you can select the interfaces that you saw on the launch pad.
The same thing with the options, you can start and stop the capture.
Set the pre-capture filter, or refresh the interfaces.
So, for example, if you disabled an interface
within Windows or Linux, and it's off and you want to refresh it,
you can then refresh the interfaces and then it will show specifically
what it is that you have as an option to capture with.
And that's it. Alright, so we move in to a couple of quick questions.
This is basically how you start and run a capture on Wireshark.
It's not incredibly difficult but we did a lot of work to get here.
And this is the whole point of what we were trying to discuss prior to.
We just wanted to make sure that before you run Wireshark
and if this was new to you or if you were just a beginner in using it
or you didn't have a lot of advanced knowledge in using Wireshark
it's not as easy as it seems. It's not you just download it and run it,
capture data and there's my problem.
No, it's not always going to be that simple. As a matter of fact, it's not often that simple.
It requires all the information that we went through up until now
to be able to hit that start button and know what it is that you're going to capture
and why, why are you capturing it.
It required a look at what interfaces do I have configured.
Is it on the right subnet? Is it on the right segment of the network?
Is it configured correctly? Is everything set up in a way where
I have everything in my profile and it's everything that I want to see.
So, I hope that up until now, everything that you've been able to gather out of this is
at the highest level. No it's not rocket scientist, rocket science using Wireshark
it can get very complex. And as we continue on with this series and
and other series and everything it is that you will work on and do with Wireshark
it will become increasingly more complex and will become a life-long learning event.
Where as the networks, the topologies, and the protocols, and everything
continues to change and get more advanced
so will the need for you to understand it
so that when you do capture with Wireshark
you know what it is that you're looking for and why you're using the tool such as this.