Managing Wireshark Files

0:00Hello and welcome. My name is Lalo Nunez. You ever open up Word Shark and see tons of packets flying by? For many people it feels impossible to even know where to begin. That's where this section comes in. We're going to step back here and build a foundation. First we'll get a clear overview of Word Shark and what it does. We'll also do a refresher on the TCP/IP model and also look at encapsulation and decapsulation. Breaking down exactly how they will move throughout the network. You and I will cover their practical stuff that's opening, saving or exporting our packet captures.

0:30We'll also see the differences between the PCAP and the PCAP NG, Word Shark file format. By the end of this set of videos you'll feel way more control when you fire up Word Shark. Thank you for allowing me to be part of your journey. Let's get started and dive in.

0:00At some point, probably have gone to a restaurant, place your order and the food may take a while to come to your table. Then you begin to wonder what's going on in that kitchen. Not really knowing what's going on behind the scenes. Maybe someone forgot to start your order or maybe their short stat today. We had the same question when running an application and wondering why is it so slow. That's where a tool like Warrashark comes in that allows us to see underneath the hood or behind the curtain. Warrashark allows us to see that traffic on our endpoint and also on our network. So in this video, we'll dig into what Warrashark is and why professionals will be united for troubleshooting and also analysis.

0:35So Warrashark is a network packet or protocol analyzer. So here it allows us to capture that traffic and also allow for a deep inspection of that traffic including protocols, different headers and payloads. Warrashark is free and open source, meaning that Warrashark is distributed under the general public license and maintained by an active community. And Warrashark is also considered to be the standard when it comes to packet analysis. As I mentioned before, we can capture traffic but also Warrashark allows us to save that packet capture therefore allowing for that analysis at a later time or maybe a one-shred is packet capture with a team member.

1:18Warrashark can decode capture traffic when there should be a deep right there. Since something called the sectors. So the sectors are a piece of code or a module that knows how to interpret the contents of a specific protocol. For example, we have different types of the sectors, one being port-based. So here these types of the sectors are bound to Warr known ports. For example, TCP80 is bound to HTTP traffic.

1:53But Warrashark doesn't only rely on ports. We also have heuristic sectors and here Warrashark is inspecting or looking inside the data for any recognizable patterns, not just port numbers. So here Warrashark can be looking inside the packet payload or for certain protocol-specific markers, for example, for HTTP, let's say for whatever reason, this website was being hosted on port 8181.

2:24Warrashark has invaded with heuristic sectors to look inside the data and see that someone initiated a HTTP request for a website and also received back an HTTP response to that request. So here Warrashark can determine this is HTTP traffic, not because of the port number, but by looking inside the data once again, and looking for protocol-specific markers. We also have user-configured the sectors where we can manually override or assign the sectors within Warrashark using a feature called the code as, which we'll take a look at later.

3:04So let's say we have an internal, custom-made chat application. Maybe the messages here being sent back and forth are similar to the HTTP protocol. And this application uses port 9000. Here we have a scenario where Warrashark may not recognize this type of traffic or protocol, but we do have the ability to, to Warrashark, treat this traffic that's going over port 9000 as HTTP traffic.

3:37At this point, Warrashark would decode this traffic as HTTP traffic, therefore allowing us to process that payload for this internal chat application so we can see it within the packet capture. So a question that may pop up for many of us is what can Warrashark do for us? It can determine the top talkers are on their work. Here we can identify which endpoints or hosts are sending or receiving the most data. We can also identify what applications are being used.

4:08By using those sectors, Warrashark can detect and label protocols, for example, HTTP, DNS, maybe FTP for example, and it does so by interpreting those port numbers along with protocol signatures, therefore showing us what applications are active on our network. Warrashark can also identify what protocols are being used. Later we'll see that Warrashark can process a packet capture and then list all the different protocols that are contained within that packet capture.

4:39And you see a big one, Warrashark can identify packet errors. So here we have the ability to see if packets are being dropped, or maybe we're having protocol errors. We also have a scenario where packets are being re-transmitted for whatever reason, or maybe it will show us any application errors. So now let's look at a couple of scenarios where you and I would use Warrashark in our production environment.

5:13One being troubleshooting slow connections. Maybe folks are complaining that a website or an application is really slow. So here we can look for delays or re-transmissions. We also can debug protocol issues. Maybe we have packets that are not formed, therefore not being processed correctly. Maybe we're looking at a security incident response. So let's say those of Matt in the middle attack where attackers were intercept ing traffic and we want to look at a packet capture to look for any modified ARP messages.

5:43We also have voiceover IP call analysis. So maybe you get a ticket saying that they're unable to complete calls and looking at a packet capture, we determine that the wrong codec is being advertised or used. And a codec is a component that compresses and decompresses voice data to the audio and the video so it can be transmitted over IP networks. We also have protocol learning. A better way to see how protocols work by seeing the packets going back and forth within a packet capture.

6:15When we're talking about packet capture, we're talking about the process of recording network traffic as it travels across our network in a wired wireless. For example, let's say this user, this client, is reporting that their internet connection or network connection is really slow. So what we can do is perform a packet capture here. Taking that traffic going back and forth, identifying any packet loss or if traffic is being retransmitted. Then we can sync that traffic in different formats, including PCAP or PCAP NG when the NG stands for next generation.

6:51And later we see the differences between both file formats. All right. So let's see where we can get wire shark. So if we go to wire shark.org, we have an option here to download now. And if we go toward the bottom here, we should see a section here for frequently asked questions. I'm going to go to what platforms are the wire shark support. Let's go to the download page. And if you scroll down a bit, we get to a different section here for a complete list of system requirements and supported platforms.

7:23We go here. So let's take a road trip over there. We can see here that it is supported on Windows, along with Mac OS. And also different flavors of units and lids. Now wire shark also has a command line version. And that version is called T-Shark. So T-Shark can form packet captures and also uses the sectors as wire shark does, but without the graphical interface. So here this is used a lot for servers or maybe automation scripts or in situations where we don't have a GUI.

7:57Now, so you know, following video, but we'll look at the OSI model along with the T-Shark ACPIP model, which allows us to see where different protocols and packets live, which is great when it comes to dissecting capture traffic. [BLANK_AUDIO]

0:00For many folks, Wireshark is overwhelming because they see a sea of packet data . That's a frustration that many folks feel when looking at a packet capture. In this video, take a look at frameworks, the OSI model along with the TCP/IP model that tells us what's occurring at each step when we're sending data from source over to destination. So knowing what layer is responsible for what makes it easier when it comes to interpreting a packet capture. The OSI model or the Open Systems Interconnection model is a conceptual framework or guideline that was developed by the International Organization for Standardization.

0:36Imagine saying that 10 times over. What this model does is organize network communication into seven different layers. In fact, I remember back in the day, I remember I had these layers with this sentence, "All people seem to need data processing." You also have a TCP/IP model. This is defined by RFC 1122 along with 1123. Now the TCP/IP model was not created to replace OSI, but to solve a challenge at that time when this was created to enable different types of computers and networks to communicate in a reliable fashion with standard protocols like TCP and IP.

1:21The OSI had seven layers, and we can see that the TCP/IP model has four layers. We have application which combines layers 5 through 7 of the OSI model. We have transport which is the same in the OSI model. For OSI has network, we have internet. Then we have a link layer that combines the daily link and physical layer of the OSI model. Now here to my right you'll see five layers.

1:54This is used a lot in learning environments where we're stretching once again a link layer into two different layers in order to align with the OSI model. And what this does is allow you to see where concepts like Ethernet along with cables and wireless signals fit in. For keeping in mind when it comes to the official TCP/IP model according to the IRC, the link layer includes everything that we need to put bits on the wire which we see shortly will include the MAC addressing, the frame structure, but also the signaling.

2:28You also see the internet layer sometimes called the network layer once again to align with the OSI model for teaching environments. Alright so for the rest of the video we'll step with this model right here. So now let's take a look at the protocols along with the different daily units you will see each layer of the TCP/IP model. So first we have the application layer. So this would be everything user facing or service oriented. We have DNS or domain name system. This converts domain names to IP addresses so we can connect to them either locally on our network or over the internet.

3:05We also have DHCP which is dynamic host configuration protocol. And this protocol automatically assigns IP addresses along with other network settings to devices on our network. We have HTTP that's hyper test transfer protocol. This would be our web browsers and servers communicate to deliver web pages for example along with images and files. We have SMB which is server meshes block, this enables files and prints sharing between computers, really in one of those environments.

3:38We have SQL that structure query language. This is how we would retrieve information from a database. We have FTP for file transfer protocol. So we can use this protocol to upload and download files to inform a remote server on our network. We have SMTP or simple mail transfer protocol. This is used to send mail from clients to servers and between servers. And we have SMB. This is used to monitor and manage network devices like routers, switches, servers, along with many other types of devices.

4:12But these are only some of the protocols that we would find at the application layer. Now we also have PDUs. This stands for protocol data unit. This is the block of data that is being exchanged at certain layers of the OSI or TCP/IP model. And the name of the PDU will change depending on what layer of the model that you are on. Here let's say that someone was trying to get to a webpage. At this point that HTTP request is simply data.

4:42So here we have a data PDU. Now next we have our transfer layer. And here we are providing end-to-end communication between two different hosts. So our transfer layer answers the question, how do we deliver this data? So we can do so in one or two ways either by TCP and here we have reliable connectivity. Or we have UDP that gives us connectionless connectivity.

5:16So your TCP is connection oriented. Meaning that our data is being received successfully and in a certain order by our destination. And any lost data is retransmitted. So again we have this guarantee of delivery. Now with UDP or connectionless connectivity we don't have any guarantee of that data being delivered.

5:51And now with no guarantee that the data is being received in certain order. And we also have no retransmissions. Now later in the course we'll dive a lot deeper into TCP and UDP. But to give you an analogy here let's say when they send a letter to KIF. So we have two options. I can send this as registered mail. Meaning when I go to the post office I get a receipt that allows me to track that package until it gets to its destination that being keys home.

6:27When this letter is delivered to keys home he has to sign for it. Therefore confirming delivery. So this is like TCP. Or I can just drop it in my mail box. And here I have no tracking, I have no guarantee. I just hope that it arrives to keys house. In fact, KIF will never have to sign for this postcard. Therefore I will never have confirmed delivery. So this is like UDP. And we think to yourself, whatever use UDP that was the purpose.

6:58We have some protocols in application. What they preference is for a fast connection where occasional packet loss is acceptable. So one big one being voice over IP. Especially when you come to the audio portion of the conversation. So I'm talking to KIF on the phone when we're having a conversation. And we're doing so over UDP. And if the occasional word drops out that's okay. Me and KIF should be able to make out what we're trying to tell each other. But in the event that this was TCP.

7:32At that point during the conversation many packets are being lost or have to be resent. At that point that will result in choppy conversations. Why because we're TCP we're waiting for those missing packets to be re transmitted before playing the audio. This is the reason why some protocols prefer UDP over TCP. So going back to a transport layer and the PDU or protocol data unit. We're doing TCP is called a segment. We're doing UDP then it's called a data grant.

8:02And here at the transport layer we're adding source along with destination port numbers. All right next we have our network layer and here this layer determines the path that data should take through our network. Or in other words what is data that need to go. At the network layer we have the protocol IP and here a PDU is now a packet. And here we're adding source and destination IP addresses.

8:34All right next we have our daily layer and here we have a connect which is a data link layer protocol. That's what they find the frame format frame being the PDU here at this layer. Also they find the MAC address along with error tricking and rules. So a lot of local network communication. So here we're dealing with source in destination MAC addresses. We also have ARP here which is the address resolution protocol.

9:06And here we're mapping an IP address to a MAC address. When we have a device that wants to send data to an IP address on the local area network that device needs the MAC address with the destination. And it gets this MAC address from the IP address by sending an ARP request which is really our broadcast and receiving back an ARP reply. So we'll definitely see ARP in action later in the course. Then we have the physical layer which is the bits on the wire. So here we're converting the frames into physical signals like electricity, light or radio.

9:44So here we're actually sending the raw data, the zeros and ones over some type of medium. So cables, fiber optics for example or radio waves. So in doing so is carrying our data as signals. So we're converting our frames into raw signals or bits. The eventually when the data gets to a destination it will convert those raw signals, those bits back into frames. So in this video we spent some time looking at the TCP/IP model.

10:16And when what Eastlayer does, what it's responsible for and what type of PDU is you will see Eastlayer will definitely make our lives easier when we're looking at packet captures. The unifalling video will look at an example of encapsulation and decapsulation . [BLANK_AUDIO]

0:00You may have seen these toys called Russian dolls. You take a smaller doll, then put it into a bigger doll, then you take that doll, and put it into a bigger doll, and so on, until eventually you get one big doll. It's kind of like how encapsulation works. Each layer of the TCP/IP model or a side model adds a header to the original data. Then using our analogy, at the physical layer, the biggest doll that contains all the smaller dolls is the data that has to be transmitted. So when our data gets to a destination, all the different layers are removed layer by layer until we get to the original data.

0:33So in this video, we'll go over a few examples of encapsulation and decapsulation of data. For first, let me take you to a quick video. So in the event you haven't seen these dolls before, that's one big doll that she's taken apart. And we see within there, we have smaller individual dolls, until eventually we get to the smallest doll in the stack, which should be right here somewhere, and there we go. So again, pretty cool if you've seen that in person. So encapsulation and decapsulation is how data is packaged for transmission, and then later unpacked when it gets to a destination.

1:11So encapsulation, we are wrapping that user data, maybe that ACTP request that we spoke about earlier, with certain protocol and specific headers, as that data passes the different layers of the OSI or TCP/IP model. So here we're preparing that data for transmission. Eventually that data will get to a destination, where it has to go through a process of decapsulation, and here we are removing those protocol headers, as it goes through different layers of the OSI model, or TCP/IP model, which eventually will reveal the original data.

1:45So when we have encapsulation, we're moving down the stack. And then when we have decapsulation, for that point we're moving up the stack. So in fact, let's go ahead and walk through our scenario. I said James opens up a webpage in his browser. Here we're going down the stack, meaning that we are encapsulating the data for transmission.

2:17Meaning we're going through a process of encapsulation so we can transmit this data. So via the browser, James, issues the HTTP request. So here we have a raw data from the web browser. So next we go to our transport layer. As we're using TCP, we have a segment here. And with an asset, we have a source port, in this case 49321, where the destination port of port 80. As we move to our network layer, now we have a packet, and that packet now has a source IP address, which is right here, along with our destination of that website.

2:56I'll keep in mind this is a high level example, to show you the process of encapsulation and decapsulation. In the production environment, we definitely have additional steps like DNS, along with routing decisions, and also possibly encryption. So again, this is only a high level example. Right next, we go to a data link, which now we have a frame, and that frame has a source MAC address, along with a destination MAC, that being the laptop. So in this case, we're assuming that this website is not internal to us, it's somewhere on the internet, so our next hub would be the MAC address of our router.

3:34Then finally, we get down to the physical layer, and here we're sending binary signals over a medium, in this case, could be your ethernet cable, and these signals will carry our data over to our destination. So that's our encapsulation. So in this scenario, James opened up a web browser, and he's expecting some data to show up within that browser, either text or images or files. So imagine if you will, if James got an answer back on our web server. So at this point, we have to go to the decapsulation process.

4:09So here we have bits, so we have the incoming signals that are being received. At that point, at the data link layer, our network card, we group those bits into a frame. Then at the network level, the router information is processed, and it's determined our destination, in James PC or web browser, at his IP address. Then at the transfer layer, we see that the destination port is this 49,321, which is on the other slide with the source port that James defined.

4:45Then at that point, the HTTP content on the web page is delivered to James browser. So in this scenario, we saw encapsulation and decapsulation. Here we have a different view of it. Originally, we have our data at the application layer. Then eventually, we have our transport layer that adds the TCP/OUDP header. So again, some of the information here, source port and destination port. Then at the network layer, we add the IP header, which has a source and destination IP address.

5:17They eventually get to the data link layer here, where we have an ethernet frame. So here we have a source and destination MAC address. All right, let's go to one more example. So once again, at the application level, we have our data. At the transport layer, we add the TCP header, in this case. Keep in mind, it's also could be UDP, but here we're adding the source port and destination port. At the network layer, we add the IP header, which includes the source and destination IP address.

5:50And then at the data link layer, we add the frame header and the frame footer. So here in our frame header, we see our source in destination MAC address. And here at the frame footer, sometimes you'll see documentation that refers to footer as trailer. But the frame footer or trailer will include a frame check sequence. Also abbreviated as FCS, but this will include a CRC, which stands for cyclic redundancy check, but the CRC is used to calculate the value based on the entire frame contents.

6:29So what occurs here is when the destination receives this data, they will recompute or recalculate the CRC to ensure that the value matches. In the event, there is no match from that CRC value. At that point, their frame is considered corrupted and therefore discarded. Then after a data link layer, their frame is sent over to the physical layer, where those frames are converted into physical signals, and that points sent over to the destination.

7:02So you see here, you see example with TCP header, but in the event that we had UDP traffic, the expectation would be to see UDP headers. So in this video, we saw the encapsulation and decapsulation of data. This is done so we can transmit this data over a network to eventually get to the destination, but they were decapsulated data, so removing its layer until they get to the original data that was sent. [BLANK_AUDIO]

0:00WordShark indeed is a great tool for capturing traffic. These captures are only useful if you can go back and view them later or share them with someone else. So in this video we'll see how we can handle our files within WordShark and it 's for specific data we needed. So here we are, our lab environment that we'll spend a lot of time in. So here I'm going to do is give myself more real estate. I'm going to minimize this section here. So at this point I'm going to open client nug. All right we'll go ahead and maximize that screen there.

0:32Here with the next lab we have two options to open up WordShark. So here we have a regular shortcut that will open up WordShark in dark mode or we have a different shortcut here that will open up in light mode. So again the preference is yours. All right we're going to use light mode here. All right and here we have our WordShark application. I'm going to do is go to file and go to open. Then here on our desktop we have a folder called packet captures that you can also add tests.

1:06And if I'm going to open is this HTTP PCP 80. So here I can choose open. I want to show you light use cancel here and in the event that we've viewed this packet capture before we also can open the file right here. Or for now let's go to file open and open that file that we mentioned. Choose open once again. You have a packet capture that we saved seriously. Before we go over how to open save and export certain data within a capture let's go over the different elements within WordShark.

1:41So first we have our title bar and here we can see the name of the packet capture file that we currently have open. We also have a test based menu right here. We also have a main toolbar here with all the different icons. We also have our filter toolbar right here that we can use to really narrow down the packets of interest within this capture. Here we have our packet list pane which shows us different roles of capture frames with basic information like source and destination the protocol being used.

2:14Now that we can remove add every all these columns as we see fit. If we pick a packet here we have our packet detail pane that will give us detailed information about the different protocols and protocol fields. We also have a pane that's currently hidden. If I go to view I'm going to packet bytes and we drag this over we'll see it right here. Here we have additional data about this packet capture but this data is in role as a decimal and ASCII format.

2:49So in fact let me expand this a little bit more and we drag this over to the middle. So to the left here is our data and it has a decimal format and to the right here is our same data but in ASCII format. And this pane is useful in the event that you want to see the exact bytes that went over the network. All right let me go ahead and hide that for now. We'll view an unshred packet byte and here to the bottom we have our status bar .

3:22So we can see here that this packet capture has 12 packets as far as profile that we're using. Currently is our default and also the name of the capture right here. You and I will spend a lot of time with the maris shark and this is just an intro of the different elements within the GUI interface. With the maris shark we have the ability to perform a live capture. You and I will definitely do that in a later video. We also have the ability to read from a file. In fact that's what you and I have done here.

3:54We went to file and to open and at this point you the packet capture that we want to open. We also have the ability to drag your packet capture into our shark. Let's go ahead and minimize that and now drag it to the right. Let's open this folder called packet captures on our desktop. What we're going to do here is take a different packet capture, drag it over to our shark and drop it and now we see that we have that packet capture open within the water shark application. Water shark has two native file formats.

4:26So you'll see PCAP and you also see PCAP and G which stands for next generation . So again these are the two native file formats to water shark. With PCAP and G being the water shark default file format. And later we dive deeper into the differences of both file formats. So let's take a road trip over to some water shark documentation. So what I'm going to go is to wire shark.org/docs and here to the very bottom we'll see a section here for documentation for users guide.

5:06Wire shark does give us the ability to consume this guide either online or offline. We're going to do choose PDF here. Let's go to page 73. We have a section here for open capture files. We're going to scroll down a little bit more. And here we see a section for input file formats. And here we have our two native formats right here. PCAP and PCAP and G. But we want to show you here that water shark can open up formats from different capturing tools.

5:41So we can see here that water shark does have the ability to open many different types of files within water shark. All right going back to our lab. Let's say we want to go to the process of saving a file. So here I can go to file and go to save as. If you have to pick our location so if I go to administrator here for example I can choose desktop. So for file name I'll give it test. So we can see our default here or PCAP and G.

6:12But we also have the option to save it as a different format. All right so we'll keep our default. Let me resize this window. And here to the bottom we have our compression options. So here our default is uncompressed. So here we're not using any compression whatsoever. So you would choose this option when this space is not an issue. Or maybe you're sharing this packet capture with someone else who may be using a different tool other than water shark and you want to guarantee readability of this packet capture.

6:45One compress will give you a larger file size. Another option here is compression with G zip. So here we're saving this space. This type of compression is compatible with many tools other than water shark. There is sometimes a compressed and decompressed packet capture especially for those large packet captures. Or maybe you're emailing this to a colleague and we're forced to compress the file.

7:16The packet capture file is small enough to transfer over email. We also have compressed with LZ4. LZ4 compression is very fast and very modern. So it's faster than G zip. It does have a very good compression. Therefore the packet capture files are smaller than uncompressed but still not as small as G zip. And any bandwidth sharing this file with someone who is not using water shark. We have to ensure that their tool wherever they're using supports this type of compression.

7:51So in fact I've tested this out. I'm going to do here a star packet capture. And no worries we'll go over this process in great detail in a future video. But just to start this process I'm going to pick the appropriate network card right here. We'll choose start. Alright so at this point I'll wait a minute or two to collect enough packets. Now to the very bottom here we see that the packet count is increasing. You also see their live capture is in process.

8:23Then in the title bar we see the network card that we're capturing traffic from . So I'm going to stop it here. We have about 2200 packets. I'm going to do is go to file. Go to save as. I want to go to my desktop here. I'm going to call this uncompressed. If we're doing so we'll make a new folder or this test. Let's go inside test and we'll save it. Alright we're going to go to file and save as once again.

8:57But this time I'm going to name it compress dash gzip. And let me go ahead and choose that option there and then hit save. Let's go ahead and go back and open up the uncompressed version. We'll do file and save as. And this time we'll choose that third option. Compressed with lz4. We'll do name compress lz4.

9:28Hit save. Do not go to that folder. Let's go to the desktop here. Go to test. And here we can see the differences in file sizes. Keep in mind I did this for a small sample. Meaning that this was not a large packet capture. So for uncompressed we see the size being 268 kilobytes. We do see with gzip compression that our file size went down to 35 kilobytes.

10:00When using lz4 compression we definitely see the file decreasing size down to 54 kilobytes but not as small as gzip. Alright so we're going back to our packet capture. There are times where we want to export certain packets within that capture. So let's say we want to focus on only DNS packets. Now later we'll cover display filters. But one of them is one called DNS. Sorry about that color there it's kind of hard to see but if I hit enter here. For now our takeaway is that we're now focusing on DNS packets.

10:34So in fact now on our status bar we have a total of 2187 packets but now we're only showing 1800 that are related to DNS. So let's say we were having DNS issues and I want to show you this packet capture we're keeping. So what I can do here is go to file then go down to this option "Export Specified Packets". Let me go ahead and resize this window. So our default is to save all packets.

11:07But now we have two radio buttons here. One "Capture" which means if I select this all 2187 packets will be saved. Or again only export those packets that are currently being displayed. In this case 1800. Also have the option to only export those packets to I select. Let me hit cancel here and let's say I marked these packets right here. Alright so there we have 1, 2, 3, 4, 5 packets.

11:38We'll file go to export specified packets. I'll resize this window once again. And now I have to select this option here. At this point it will export those five packets and those five packets only. We also have the option here for marked packets. So once again I'll choose cancel here and let's say this packet here was a interest. So I can do a right click here. Let's say this other packet here. Let me pick a random one right there.

12:10It's also of interest. So I can right click here and also go to mark. So now I go to file and go back to "Export Specified Packets". And look at our options now. You saw me mark two packets. So indeed when I chose the option there I have the ability to only export those two packets. We also have the option first to last mark. And what this would do is go ahead and save all the packets between the first and last packet that I marked in this case 53.

12:43Also I have the ability to pick a ranger packet. So when I export it will be packaged 51 through 200. Also I have the option to remove any ignore packets. So I also have the ability here to ignore a packet. So let me go a little bit higher. Choose this one. Choose ignore. Alright and the bottom here we see some packets remarked. So I'm going to ignore. So at this point I go back to export specified packets. And let me resize that window once again. So here we see a corner one for ignore packets.

13:16And the reason it's not in the display column is once I ignore a packet it still is this within a packet capture. But that packet is no longer displayed in this packetless pane. In fact I got a caption here. We now see the ability to remove ignore packets. Alright so going back to the displayed here. They may have found an option here. Include dependent upon packets. So I'd say that we have related packets like TCP handshakes or maybe fragments.

13:47These packets will also be included in the event. The packets that were currently exporting depend on them. This helps us avoid exporting incomplete traffic flows. Alright so we'll name this specific packets. So we see a count here 1,799. That was 1800 until we ignore the packet. That's for going ahead save. Alright now let's go ahead and close our chart. We see our file that we just saved specific packets.

14:17Let's open up our chart. So in fact we'll go ahead and open it right from here. And there we go. Now we have a capture file. That only includes those packets that we exported. Now finally if we do a file we add the option to the close or quit. So what close does is it closes to currently open capture file or live capture window. But we can see that the wire shark remains to be open. We'll write it to open our file once again and go to file and quit.

14:50So now that we're closing the file we're also editing the entire wire shark application. So in this video we wanted a process of opening, saving and closing files within wire shark. And also exporting certain packets of interest within the wire shark application.

0:00Not all packet captures are created equal. In this video, we'll break down the differences between PCAP and PCAP and G, so you know which one to use and why it matters. So PCAP stands for packet capture. And this was the original simple file format that was used for packet captures. So our PCAP file stores network packets as flat records, meaning that each packet is written sequentially one after the other. And also each packet is self contained.

0:30Meaning that everything needed to describe the single packet is stored inside the record itself. So again, a PCAP file stores network packets as flat records with basic metadata, for example, timestamp, packet link, and a packet data itself. And the metadata is important, especially when trying to understand the actual packet capture, for example, when and where something occurred, without needing to decode every single byte of information or raw data.

1:00PCAP format does not support any information about the capture source. For example, here we're talking about the system that took the packet capture, along with interface or any annotating packets. So here we're talking about adding notes or comments to the packets within our packet capture that can be viewed later by us or someone else. And the PCAP format is widely supported across different tools, other than water shark. And it's really good for smaller captures or really not designed for extens ibility or very large files.

1:35And also all packets in the PCAP file are assumed to come from a single link layer type. So meaning that all packets either came from the ethernet type or from Wi-Fi. So with the PCAP format, we could emit captures from both the ethernet and wireless adapter in the same file. So a PCAP NG, NG stands for next generation.

2:09And this was designed to address the PCAP file format limitation. So here we can allow packets to be captured from multiple interfaces or link layer types in a single file. So again, both ethernet and wireless for example. It also supports storm and extensive metadata. So here we can include details like interface descriptions or comments or annotations made to packets along with encryption keys. But this is only some examples of the additional metadata that we can obtain with the PCAP NG format.

2:45And this format became wire shark's default since version 1.8. We can see here by the year 2012 has been a long time. So in the event we're looking to obtain a basic packet capture or that capture to be compatible with all the tools, at that point we would go with the PCAP format. But in the event we want that advanced analysis, especially if our networks are complex and we need that additional detail, at that point we will go with PCAP NG. All right, so let's go over to our lab.

3:16All right, we're just right here. All right, so let me get rid of these right here. Let's open up our uncompressed. We can see by the title bar, this is saying it as a PCAP NG. I'm going to do this go file, save as I want to save it as PCAP. And we'll name this uncomp ressed. PCAP. And then hit save. So now I'm going to show you the difference between PCAP and PCAP NG. So if we go to statistics here, go to capture file properties. I'm going to open up a second wire shark window here. Let's go to file and to open. I'm going to open the original uncompressed PCAP NG. Choose open there. We'll go to the same place, statistics and capture file properties.

4:09What I want to do is put these two windows side by side. And here we'll see some of the major differences. So on the left here we have PCAP format. And then the right here we have PCAP NG. So our file size for PCAP is 233 kilobytes. And the right is 273. The PCAP NG file is larger due to the extra metadata. Now for PCAP we have no information about the capture device. In fact, we see here unknown.

4:44For PCAP NG, we see the hardware, the operating system, and also the version of our shark. This information is great, especially if this system is having the issue and you want to duplicate this environment for testing purposes. So here for interfaces, we have unknown. But for PCAP NG, you see the name of the interface. We also see drop packets at 0%. For this information unknown for our PCAP file.

5:15So we definitely can see some of the differences between the two file formats. In fact, let me go back to the PCAP NG file. Let me close this, close this. So we have a file right here. Let's say about to comment on this file. So packet comments, add new comment. This is a test. All right, with that in place, I will hit OK. So we can see the packet comment right there. I'm going to do a save as once again.

5:45So this time, I'll name this test one dash PCAP NG, hit save, I'll do a save as once again, but this time we'll save as PCAP. So test two dash PCAP hit save. We see a warning here. This file format you chose did not support comments. You want to say the packet capture in a format that does support comments. So we'll go ahead and choose this card comments and save. So now in this PCAP format, if we go to packet one, that comment is no longer there.

6:17But if I go back to the other one that we save, this test one PCAP NG, we see it does retain those comments. So in this video, we saw a difference between different capture file formats, really focusing on PCAP versus PCAP NG. We also went over the benefits. Now we know why the default for War Shark is to save the file format or capture file as PCAP NG or Net Generation.

0:00Good job, make it to the end of the skill. In this bad asian section, we're going to use your newly obtained knowledge to launch the lab environment and answer a few questions. Let's get started and dive in. So in this section, your tasks include launching the lab link below, which we see right here. Then navigate into the client structure cut on the desktop. And on the desktop, we want to go to a folder called package capture, then launch this file right here. All right, so I do have his lab already running.

0:31So let me close his lab panel right there. Let's go to client nug. All right. So on the desktop here, we have a folder called package captures. It will open it up. Now at this point, we want to open up this file right here. All right. So let's see where our first question is. You'll be screw down a bit. And the wire search status bar, how many packets are in this capture file? All right, going back to our lab. All right.

1:01So our status bar is right down here. We can see that we have a total of 43 packets. All right. So going back to our question, we'll go ahead and choose 43 and submit going to question number two, but that file is still open. We want to go to statistics capture file properties, what operating system was a capture device running? All right. So let's go ahead and check that out. So we're going to go to statistics capture for properties.

1:35We can see he had the bare running 64 bit version of Windows 11. All right. So let's go back to our question. We'll go ahead and choose that as a correct answer and hit submit. All right. So we're going to go ahead and select the number three, and then we're going to go ahead and select the number three. All right. So we're going to go ahead and select the number three, and then we're going to go ahead and select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we 're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we

2:51're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we 're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and then we're going to select the number three, and