One of the important things I want to highlight
before we start the next round of modules is
saving of data and protection of data.
Some of the questions that come up are
how dangerous is a Wireshark or any type of a sniffer related data file
and how important is it to keep it secure.
So as network analysts, as engineers, systems administrators, anyone working in IT,
keeping information secure is probably one of our most greatest responsibilities.
If you work in healthcare,
you have to make sure that your patient's information is protected.
If you work in financial realms,
you have to make sure that client's information is protected.
If you're working in the military, it might be confidential. Law enforcement.
We work in data
and there's nothing that's going to get closer to working with that data,
than doing Wireshark captures because you're collecting the data in transit and
you're able to see within it specifically, and some cases, you can decrypt it.
You can replay it. You can find out where it's going. You can see who sent it.
So the ability to see inside this data and to collect this data is a responsibility
that we must take very seriously and when you save it,
you should always make sure that it's secure.
So make sure that you put it on a safe drive and encrypt it.
Or safe share and encrypted. Just make sure that you're keeping this data secure
and you're not leaving it out there for others to see or to capture
because it could reveal quite a bit about what's going on on the network as well as
personal or client or employee information that we want to keep secure.
So, that's a common question that comes up and we just wanted to make sure that
it's well understood and it's due diligence to ensure that you secure this data
appropriately and make sure that it does not get into the wrong hands.
In our next module, we will be discussing the saving of capture files.
It is also something that you may see, I think it's quite easy to do.
But there's a handful of file formats you should be aware of and some other things
involved in the saving of captures that is quite important.
So, saving files is a great responsibility.
It is one where it can contain sensitive information.
And what we want to do as network analysts is make sure that we encrypt this data
if it's going to be at rest on our drives, or put it on an encrypted drive or
just make sure that it is out of people's hands
so that if it got into the wrong hands, out of your hands or into the wrong hands,
it is safeguarded so that the information within it
cannot be used against the customer, client or your employer.
So just make sure that when you're saving files,
you're doing due diligence and ensuring that you're thinking of safety.
So you can set up Wireshark to save data into a file or multiple files.
You can save it in a compressed format using Gzip,
and you can save it in different file formats
for example, when we're talking about annotations, you can use the old Pcap,
file extension or the new Pcap-ng file extension so that you can ensure
that your report and annotation information stays intact.
So as you can see, saving files can be a little tricky.
There's not, there is a way to just file save as,
save as the filename and keep going but there's some specific things that you could do
to ensure that you're saving your data correctly or accurately.
So the first tip we will give you is to try to save the capture in a way where it's intelligent.
One of the ways I like to do it is to flag it as a capture file.
This is the most generic way to do it. I try to always put the date.
You can extend it into specific periods of time.
You can add the application. You can add the work station
or the system name that you're scanning from or to.
There's a lot of ways to do this but it's better
to save it intelligently and in a dedicated share on your system for captures
than to just arbitrarily save it as capture.
Capture 1, capture 2 and so on because then you're going to have to go in
and hopefully you left some annotation notes for yourself as to what it had to do with.
But if not, then you're just going to have a large amount of captures that you really don't know
what they correlate to specifically.
So after capture is completed, you can save or save as
which we will show in a moment.
There are some differences. So with Linux and Unix,
obviously you have the GTK plus or the GIMP toolkit.
And the extended interface so there are some differences when you go to save the capture.
In the dialog boxes, pay close attention to that 'cause there's different options available.
And you can also print the files directly out
and not save them as data at all. You can just print it out.
This will, if it's a capture of a couple of packets, this is helpful.
Otherwise, your printer is going to probably go through 5 reams of paper.
So it's important for you to consider what it is that you're printing.
So, that being said, if you're also going to print
make sure that you again do due diligence
and you shred the data if it, in fact shows sensitive information.
So if you're going to save a capture and this is one that I just ran and I haven't saved it yet.
I can file save as and it will open up the dialog box.
I have it in a sample capture folder. I have a dedicated folder where I put these.
And I am going to name this, sample capture with today's date.
And then I can select the format. So as we mentioned earlier,
there's quite a few formats that you can select between.
You can save in formats where if you wanted to read it directly from network,
Microsoft's network monitor, you can do so.
You can do so from, here some other example, the ancient Novell LANalyzer,
which is probably around 20 years old as of now.
There's different things that you can use.
Visual networks, those are the old boxes that you used to put on your frame
network to analyze it. Those types of things, there's some old stuff in here.
But in general, you're going to probably save this as Pcap or Pcap-ng.
I had some notes in here so I'm going to save it as Pcap-ng.
And then I'm also going to choose to compress
with Gzip so that it shrinks it down in size.
It doesn't take a large portion up on my disc or take up space.
Alright, so as you can see, 'cause I saved with Pcap-ng,
I was able to retain some information and we are good.
So there's also another option, you can output to a file, the data.
So if you were to print, you can do a print out to a file.
I've named this one Wireshark out. I can set all packets and here I have a
displayed about 1500 plus packets.
I can select the range or just the selected packets that I select arbitrarily,
and or I can display or collapse packet details to shrink the amount of information but
this is also another option that you can select the file to output 2.
So question came up on annotation files and the question was -
'is annotation mainly the documentation of your traces?'
So when you do a trace and you collect a data,
annotation allows you to move directly
to making notes in that trace file or that capture file.
So, yes you are documenting inside the file itself.
So that's what you want to remember is that it's actually making notes within
the capture or what you will call, also a trace file.
And it's just critically important that you save it as Pcap-ng
otherwise you will not retain that information.
And the 2 ways you can do it is you can add notes to the packet
and you can add notes directly to the entire capture.