In our next module, we will discuss navigation.
Navigation is key to working effectively and efficiently with Wireshark.
Being able to navigate the interface is critically important.
Being able to open, start a capture. We talked briefly about this yesterday.
when we did, when we're talking about setting up profiles and adjusting preferences.
But once you have all those stuff adjusted and you're able to start your capture,
once you have captured data, exactly what you're going to do with it
which is what we'll learn in all the rest of the modules - use the tools.
To be able to do that you have to know how to navigate the interface.
So in this module, we're going to talk specifically
about how to get through the interface.
Alright, so with Wireshark, navigating a Wireshark interface
you will be able to quickly navigate through the tool,
and find, use, and work with captured data.
So we talked yesterday, yesterday about the launch pad or the start page -
where you can begin your capture, select the interface,
set up capture options, pre-capture filters,
saving options so it will chop the data up into multiple files,
so it's not one big capture.
But once you actually start the capture, you're going to open up into the capture window.
So with the capture window, one of the things that you're going to start off with is
the file menu, and each one of these menu options here as you see
will give you most of what it is that you need to get to within Wireshark.
So just really quickly, the file menu is
responsible for opening and closing your captures.
You can save them. We have one module on how to save them 'cause
there's so many different formats and things that
you need to learn about the saving of the captures.
You can review if this was a file set.
If we chop the files up, we could save them
in multiple files and you could browse through them.
You could see them in the list of files.
We will learn about exporting.
You can export objects. This is helpful when you want
to see the TCP objects as we just learned
about this HTTP capture, this is helpful to give you a view into specifics.
Let's say, we wanted to see the size or we wanted to see
what packets map to what objects.
We can print, print packets and or quit the program.
The edit file menu - you can use this to find specific packets.
We will look at that momentarily.
You can mark and annotate packets which we'll look at in a separate module.
This is important for, if you wanted to
for example, make reference to what this is.
You can now with Pcap-ng file formats.
You can save specific things.
And annotate, you know, the entire file and or, sorry, hit the wrong thing.
So you can specifically save data in the comments.
So there's a lot of things that you can do to edit the file itself.
You can switch through and change your preferences or adjust your profiles.
You can also select it down here.
In the view menu, you can adjust and select which toolbars you'd like to see.
So for example, if we do not want to see wireless setting,
things we can adjsut, we can turn it off.
We can turn it on. There's a lot of things that are available to you in the interface
so you're able to turn them off and on here.
What we just learned about was adjusting the time.
So you can change the time format.
You can turn on and off name resolution.
You can also adjust that in your preferences to do that every single time.
You can adjust the zooming so I actually zoomed
in here so that you could see things easier.
And you can also zoom out. You can readjust it to normal size.
You can resize your columns so as an example,
if you're adjusting this you can quickly resize them.
You can display columns. In preferences, you can add more columns.
Here, you can take away or add columns at will.
You can also move them very easily, if needed.
If you want to adjust something, you can just move the column.
You can get to your coloring rules which we briefly talked about
to change specifics in the capture.
How things are viewed - you can completely reload the capture, reload the interface.
What we'd like to talk about next is the go menu and specifically,
when you move around the actual capture,
you can use the go menu to help navigate the data.
So it's actually pretty simplistic in nature but
this toolbar will allow you to essentially move through the packets.
You can go to the next packet and move through the,
obviously you can scroll through.
But this provides you a quick way to navigate.
One of the more helpful ones is at the end.
You can go to a, the beginning or the end of the capture.
So we'll show you that.
So if you wanted to get to the beginning of the capture
and or if you wanted to get to the end of the capture.
So, there's different ways to navigate.
Through the capture itself, you can move through it
or you can go to the beginning or the end but
regardless, this tool will allow you to navigate the capture itself pretty quickly and easily.
So, why would we want to navigate through these files?
Well, one of the things here is I have a capture display here.
Let me put this back up for you.
I put a, let me clear and I'll show you.
But if you wanted to specifically get to the beginning of a HTTP conversation,
instead of scrolling all around this large capture, and this isn't really a large one,
we only have about a, maybe a few hundred packets.
I can get to the beginning of the capture, get to the end of the capture,
and start navigating through the capture based on the filter that I applied.
So that could be very helpful to you if that's a, if, if you find out that it's quicker and easier
to get you around the capture.
So other navigation features, obviously we started going through the file menus.
That's one thing where everything that you need,
could be found primarily within the menu options.
So as we go through and learn about the tools, we get more into the statistics menu.
Touch on a lot of the tools in there.
There's specific telephony and or if you're troubleshooting voice.
There's a whole menu system for that.
But get comfortable with navigating the menu system
'cause it's really going to give you a bird's eyeview into what
Wireshark has to offer.
And again, don't forget about the main interface.
The main interface will provide you with a lot of different options
that we already started going through, as we mentioned you can navigate through it.
You have some capture stuff in here where you can select your interfaces.
This is the same as if you were in the launch pad.
Do you want to change interfaces. You can change options on the interface.
Again, this was off the main launch pad
but you can see specifically which interface was used to run the capture.
You can start and stop the capture.
Obviously, if you've already started one, it will ask you to save it.
We recommend that if you're saving captures, obviously
you will want to find a spot on your hard drive.
Don't you stamp them into documents, maybe create a capture folder.
But to start and stop captures, you will have to save it.
You can set some pre-defined capture filters.
This is for the next capture. Obviously, we can apply capture filter 2.
ARD capture, already established capture, we can apply a display filter to it.
And again, we can refresh the interfaces.
In analyze, we can look at display filters.
We can set up macros and we can file the TCP stream.
For example, if we have a conversation here as we can see,
we can see the whole conversation in the stream.
So we can get through that. One of the tips to navigating
is we have a right click context menu for the packets list and the details pane.
So if you wanted to see some specific information
you wanted to see this conversation in particular,
you can file the TCP stream there. It will apply this conversation filter directly in.
And then you can see specifically the stream for that conversation.
So, that's what you can get from the analyze.
You can also view the Expert. We will get directly into the Expert in more depth
but the Expert is a, I like to call it a clue system.
It will give you some specific information so as an example here,
we had some out of order segments. If we were interested in figuring that out,
we can click on that and it will take us directly to the numbered packet.
So in this example, it's showing in the summary that it was packet 141.
We were able to double click on that and it was able to take us to packet 141.
Then we can drill down into the details of that specific data
and look at what the Expert flagged.
So again, this is just learning how to navigate the system
so that when we start getting into the, the more granular detail,
we'll understand how to move around Wireshark and where things are located.
So we have a lot of drop-down menus.
We have pane navigation, right click context menus.
The toolbars, in particular, we started looking at them.
You can turn them on and off.
We can set up a filter through the filtering toolbar.
So there's a lot of things in here that we can work
with when it comes to navigating Wireshark.
It's very user-friendly.