Essentially, what's interesting about sample captures is
for those of you new to Wireshark or
have not necessarily worked with Wireshark for a long time,
you may not know what it is that you're trying to look for.
So as an example, with DHCP and DORA,
you may not know what a complete DORA is supposed to look like.
So using sample captures is a way where you can really take a look at
what some of these captures should look like so that you have a baseline.
It helps you to study so that when you're looking up things in RC's or
if you're trying to figure out technically how something should look,
these sample captures will provide some guidance into how to do that.
So this is not going to be an incredibly long module
but it is an important one for those who are starting down the path of using Wireshark.
One of the greatest things that I've seen
about the Wireshark website is the community.
It's got such a robust community of people who are really interested
in not only making this a great product but
a really interested in helping each other learn and develop.
I've gotten a great deal out of it over the years,
and I try to participate as much as possible.
It's really helpful to review a lot of these data
and see what it is that they have to offer.
So, I've pulled a lot of it down and we'll review some of it in this module.
But I, I would like to say that it's, it's in your best interest
to definitely visit the website, go to the sample repository
and start looking around and pulling some of the stuff and taking a look at it.
A lot of what's on there, too, is actual problems.
So, for example, some of the issues that we've seen as network engineers
is things where we may have a problem with a handshake.
or we may have a problem where we don't understand why
TCP is acting a certain way.
If we get a whole bunch of reset packets,
is that abnormal and why would that be abnormal.
So when you look at these sample captures there's some dialog with it as well
to help you get through and understand some specifics as to what it is
and why, why it was captured.
Other examples and some of the stuff that I've, I've used extensively -
when I started learning about version 6
is actually running a capture on IP version 6 and just
really taking a look inside the packet and seeing what that's all about.
So there's some extensive version 6 stuff up there as well.
So to get this stuff, you can go to the wireshark wiki.
It's online at wiki.wireshark.org/SamleCaptures. The url is there.
You can download and you could submit sample captures.
So, I pulled the page so that we can see it. I'll enlarge here for you.
So as you can see there's a tremendous amount of data -
there's SMB, there's ARP, there's spanning tree, telnet.
There's literally anything that it is that you would be
interested in looking at that you may not have a baseline for.
There's a lot of good stuff up here to check out.
What I've also done is I've downloaded some of it
so that you can get a bird's eyeview into what it is that
they're actually download, you can download.
So standby, I'll pull it up in Wireshark.
So what you can do from the launch page or the start page itself is
in the file section previously we were either starting a capture here in the capture section
or we were going to open one. But what if we wanted to
check out a sample capture.
Well, there we go and it'll take you directy to whatever it is that you want to see.
You can select it and download it. So we'll pick something here.
And as you can see, you have your pcap files.
or your gzip compressed file so we'll just take something here 6 to 4.
And there you go. So as we were mentioning before
one of the things that you can do is
download and navigate a whole bunch of sample captures for your review.
Again, if you're not familiar with some of these stuff
it is helpful to be able to download and check out some of the options.
It's a great learning tool because one of the things that we've done in the past
is be able to learn from example.
I have in the past, set up some media labs
in my house, at work, all over the place.
And one of the things that I like to do is run Wireshark constantly against the labs
so I'm aware of what the traffic looks like from going to place to place.
And when I come across protocols that I was not sure
or I was unaware of what they were really doing,
I would commonly come to Wireshark to just the website, the wiki
to see if anyone was discussing it and or if there's a sample capture for it.
So moving back into the module as we discussed
find, download, cap, your captures and analyze them.
Check out what's in there.
Download and, you know, play with what you like to see and
you will find a great amount of sample captures for you to work through.
So, we pulled down one. There's obviously more that you can go through.
That this one here is some more IPV 6.
One of the things that came up in the questions was -
it was asked, are we going to look at some way to find packet loss?
So the question, the answer to that question is yes.
One of the ways to find packet loss - to first filter out
the communication from a source to destination.
So that you're just looking at that communication.
Let's look at specifically,
a client talking to a server and you want to see specifically,
do you have any loss, traffic or some packet loss between those hosts?
So, that actually plays right into the next segment
we're going to do which is on filters.
So, as we've learned, you can navigate Wireshark,
you can capture data.
You capture data from a source to a destination.
You want to now analyze the saved capture.
You want to filter specifically on that but
one of the things that we will get into and learn about as we
get through (here we go) as we get through our capture is
we're going to look at statistics in a future module.
So, as an example, if we wanted to look at packet loss,
one of the things that we could do
is we could look at the conversations in the capture.
And here we could specifically filter out which conversation and which direction.
So it will any to B, A to any. So here, if we just want to look from A to B,
now we can start looking and one of the filters that we can apply
I believe it's TCP analysis loss segment would be a common one
to look at roundtrip time problem.
So, the answer is yes. There is a way to look at the packet analysis.
And the key to doing that is actually starting with filter.
So, without any further adieu, we'll move in to the next module which will be on filter.
Alright, so why would we want to filter traffic?
Before we start the module, we'll just highlight what we discussed earlier
about capture filters and display filters. We'll talk about it in the module but
capture filters are again if you want to stop traffic from being captured at all in your capture.
We don't want it to be seen. So again, a common scenario would be
if I don't want to see any traffic for myself as a host, I can block
all that traffic and stop it completely.
I will only capture other data promiscuously.
However, a display filter would be all the data that I already captured
what is it that I want to drill down to, what would I want to find.