Managing Wireshark Files

0:00Hello and welcome. My name is Lalo Nunez. You ever open up Word Shark and see

0:04tons of packets flying by?

0:05For many people it feels impossible to even know where to begin. That's where

0:09this section comes in.

0:10We're going to step back here and build a foundation. First we'll get a clear

0:14overview of Word Shark and what it does.

0:15We'll also do a refresher on the TCP/IP model and also look at encapsulation

0:21and decapsulation.

0:22Breaking down exactly how they will move throughout the network.

0:25You and I will cover their practical stuff that's opening, saving or exporting

0:29our packet captures.

0:30We'll also see the differences between the PCAP and the PCAP NG, Word Shark

0:34file format.

0:35By the end of this set of videos you'll feel way more control when you fire up

0:39Word Shark.

0:39Thank you for allowing me to be part of your journey. Let's get started and

0:43dive in.

0:00At some point, probably have gone to a restaurant, place your order and the

0:03food may take a while

0:04to come to your table.

0:05Then you begin to wonder what's going on in that kitchen.

0:07Not really knowing what's going on behind the scenes.

0:10Maybe someone forgot to start your order or maybe their short stat today.

0:14We had the same question when running an application and wondering why is it so

0:18slow.

0:18That's where a tool like Warrashark comes in that allows us to see underneath

0:21the hood

0:22or behind the curtain.

0:23Warrashark allows us to see that traffic on our endpoint and also on our

0:26network.

0:27So in this video, we'll dig into what Warrashark is and why professionals will

0:30be united for

0:31troubleshooting and also analysis.

0:35So Warrashark is a network packet or protocol analyzer.

0:39So here it allows us to capture that traffic and also allow for a deep

0:43inspection of that

0:44traffic including protocols, different headers and payloads.

0:49Warrashark is free and open source, meaning that Warrashark is distributed

0:54under the

0:54general public license and maintained by an active community.

0:58And Warrashark is also considered to be the standard when it comes to packet

1:02analysis.

1:03As I mentioned before, we can capture traffic but also Warrashark allows us to

1:10save that

1:10packet capture therefore allowing for that analysis at a later time or maybe a

1:15one-shred

1:15is packet capture with a team member.

1:18Warrashark can decode capture traffic when there should be a deep right there.

1:23Since something called the sectors.

1:26So the sectors are a piece of code or a module that knows how to interpret the

1:31contents of

1:32a specific protocol.

1:35For example, we have different types of the sectors, one being port-based.

1:42So here these types of the sectors are bound to Warr known ports.

1:46For example, TCP80 is bound to HTTP traffic.

1:53But Warrashark doesn't only rely on ports.

1:56We also have heuristic sectors and here Warrashark is inspecting or looking

2:01inside the data for

2:02any recognizable patterns, not just port numbers.

2:06So here Warrashark can be looking inside the packet payload or for certain

2:11protocol-specific

2:12markers, for example, for HTTP, let's say for whatever reason, this website was

2:19being

2:20hosted on port 8181.

2:24Warrashark has invaded with heuristic sectors to look inside the data and see

2:29that someone

2:30initiated a HTTP request for a website and also received back an HTTP response

2:37to that

2:37request.

2:39So here Warrashark can determine this is HTTP traffic, not because of the port

2:44number, but

2:44by looking inside the data once again, and looking for protocol-specific

2:50markers.

2:51We also have user-configured the sectors where we can manually override or

2:55assign the sectors

2:57within Warrashark using a feature called the code as, which we'll take a look

3:03at later.

3:04So let's say we have an internal, custom-made chat application.

3:11Maybe the messages here being sent back and forth are similar to the HTTP

3:16protocol.

3:17And this application uses port 9000.

3:23Here we have a scenario where Warrashark may not recognize this type of traffic

3:27or protocol,

3:28but we do have the ability to, to Warrashark, treat this traffic that's going

3:32over port 9000

3:34as HTTP traffic.

3:37At this point, Warrashark would decode this traffic as HTTP traffic, therefore

3:42allowing

3:42us to process that payload for this internal chat application so we can see it

3:47within the

3:47packet capture.

3:49So a question that may pop up for many of us is what can Warrashark do for us?

3:55It can determine the top talkers are on their work.

3:59Here we can identify which endpoints or hosts are sending or receiving the most

4:03data.

4:03We can also identify what applications are being used.

4:08By using those sectors, Warrashark can detect and label protocols, for example,

4:15HTTP, DNS,

4:16maybe FTP for example, and it does so by interpreting those port numbers along

4:21with

4:21protocol signatures, therefore showing us what applications are active on our

4:26network.

4:27Warrashark can also identify what protocols are being used.

4:31Later we'll see that Warrashark can process a packet capture and then list all

4:35the different

4:36protocols that are contained within that packet capture.

4:39And you see a big one, Warrashark can identify packet errors.

4:44So here we have the ability to see if packets are being dropped, or maybe we're

4:49having protocol

4:50errors.

4:51We also have a scenario where packets are being re-transmitted for whatever

4:59reason, or maybe

5:00it will show us any application errors.

5:07So now let's look at a couple of scenarios where you and I would use Warrashark

5:11in our

5:11production environment.

5:13One being troubleshooting slow connections.

5:16Maybe folks are complaining that a website or an application is really slow.

5:20So here we can look for delays or re-transmissions.

5:23We also can debug protocol issues.

5:26Maybe we have packets that are not formed, therefore not being processed

5:31correctly.

5:32Maybe we're looking at a security incident response.

5:35So let's say those of Matt in the middle attack where attackers were intercept

5:39ing traffic

5:39and we want to look at a packet capture to look for any modified ARP messages.

5:43We also have voiceover IP call analysis.

5:48So maybe you get a ticket saying that they're unable to complete calls and

5:51looking at a

5:52packet capture, we determine that the wrong codec is being advertised or used.

5:58And a codec is a component that compresses and decompresses voice data to the

6:02audio and

6:03the video so it can be transmitted over IP networks.

6:06We also have protocol learning.

6:09A better way to see how protocols work by seeing the packets going back and

6:13forth within a

6:14packet capture.

6:15When we're talking about packet capture, we're talking about the process of

6:20recording

6:20network traffic as it travels across our network in a wired wireless.

6:25For example, let's say this user, this client, is reporting that their internet

6:29connection

6:30or network connection is really slow.

6:32So what we can do is perform a packet capture here.

6:35Taking that traffic going back and forth, identifying any packet loss or if

6:39traffic is

6:40being retransmitted.

6:41Then we can sync that traffic in different formats, including PCAP or PCAP NG

6:48when the

6:48NG stands for next generation.

6:51And later we see the differences between both file formats.

6:54All right.

6:55So let's see where we can get wire shark.

6:58So if we go to wire shark.org, we have an option here to download now.

7:03And if we go toward the bottom here, we should see a section here for

7:07frequently asked questions.

7:09I'm going to go to what platforms are the wire shark support.

7:12Let's go to the download page.

7:15And if you scroll down a bit, we get to a different section here for a complete

7:20list

7:20of system requirements and supported platforms.

7:23We go here.

7:24So let's take a road trip over there.

7:27We can see here that it is supported on Windows, along with Mac OS.

7:32And also different flavors of units and lids.

7:37Now wire shark also has a command line version.

7:39And that version is called T-Shark.

7:42So T-Shark can form packet captures and also uses the sectors as wire shark

7:48does, but without

7:49the graphical interface.

7:51So here this is used a lot for servers or maybe automation scripts or in

7:55situations

7:56where we don't have a GUI.

7:57Now, so you know, following video, but we'll look at the OSI model along with

8:02the T-Shark

8:02ACPIP model, which allows us to see where different protocols and packets live,

8:08which

8:08is great when it comes to dissecting capture traffic.

8:11[BLANK_AUDIO]

0:00For many folks, Wireshark is overwhelming because they see a sea of packet data

0:04.

0:04That's a frustration that many folks feel when looking at a packet capture.

0:08In this video, take a look at frameworks, the OSI model along with the TCP/IP

0:12model that

0:13tells us what's occurring at each step when we're sending data from source over

0:17to destination.

0:18So knowing what layer is responsible for what makes it easier when it comes to

0:22interpreting

0:23a packet capture.

0:24The OSI model or the Open Systems Interconnection model is a conceptual

0:30framework or guideline

0:32that was developed by the International Organization for Standardization.

0:36Imagine saying that 10 times over.

0:39What this model does is organize network communication into seven different

0:43layers.

0:44In fact, I remember back in the day, I remember I had these layers with this

0:48sentence, "All

0:49people seem to need data processing."

0:55You also have a TCP/IP model.

0:58This is defined by RFC 1122 along with 1123.

1:04Now the TCP/IP model was not created to replace OSI, but to solve a challenge

1:10at that time

1:11when this was created to enable different types of computers and networks to

1:16communicate

1:16in a reliable fashion with standard protocols like TCP and IP.

1:21The OSI had seven layers, and we can see that the TCP/IP model has four layers.

1:31We have application which combines layers 5 through 7 of the OSI model.

1:35We have transport which is the same in the OSI model.

1:39For OSI has network, we have internet.

1:42Then we have a link layer that combines the daily link and physical layer of

1:47the OSI model.

1:48Now here to my right you'll see five layers.

1:54This is used a lot in learning environments where we're stretching once again a

1:58link layer

1:58into two different layers in order to align with the OSI model.

2:03And what this does is allow you to see where concepts like Ethernet along with

2:08cables and

2:09wireless signals fit in.

2:11For keeping in mind when it comes to the official TCP/IP model according to the

2:16IRC, the link

2:17layer includes everything that we need to put bits on the wire which we see

2:22shortly will

2:23include the MAC addressing, the frame structure, but also the signaling.

2:28You also see the internet layer sometimes called the network layer once again

2:32to align

2:32with the OSI model for teaching environments.

2:35Alright so for the rest of the video we'll step with this model right here.

2:40So now let's take a look at the protocols along with the different daily units

2:44you will

2:45see each layer of the TCP/IP model.

2:49So first we have the application layer.

2:50So this would be everything user facing or service oriented.

2:55We have DNS or domain name system.

2:57This converts domain names to IP addresses so we can connect to them either

3:01locally on

3:02our network or over the internet.

3:05We also have DHCP which is dynamic host configuration protocol.

3:10And this protocol automatically assigns IP addresses along with other network

3:14settings

3:14to devices on our network.

3:17We have HTTP that's hyper test transfer protocol.

3:21This would be our web browsers and servers communicate to deliver web pages for

3:26example

3:27along with images and files.

3:29We have SMB which is server meshes block, this enables files and prints sharing

3:34between

3:34computers, really in one of those environments.

3:38We have SQL that structure query language.

3:41This is how we would retrieve information from a database.

3:44We have FTP for file transfer protocol.

3:47So we can use this protocol to upload and download files to inform a remote

3:51server on

3:52our network.

3:53We have SMTP or simple mail transfer protocol.

3:57This is used to send mail from clients to servers and between servers.

4:01And we have SMB.

4:03This is used to monitor and manage network devices like routers, switches,

4:09servers, along

4:09with many other types of devices.

4:12But these are only some of the protocols that we would find at the application

4:16layer.

4:16Now we also have PDUs.

4:19This stands for protocol data unit.

4:22This is the block of data that is being exchanged at certain layers of the OSI

4:28or TCP/IP model.

4:30And the name of the PDU will change depending on what layer of the model that

4:33you are on.

4:35Here let's say that someone was trying to get to a webpage.

4:38At this point that HTTP request is simply data.

4:42So here we have a data PDU.

4:44Now next we have our transfer layer.

4:47And here we are providing end-to-end communication between two different hosts.

4:51So our transfer layer answers the question, how do we deliver this data?

4:56So we can do so in one or two ways either by TCP and here we have reliable

5:09connectivity.

5:10Or we have UDP that gives us connectionless connectivity.

5:16So your TCP is connection oriented.

5:26Meaning that our data is being received successfully and in a certain order by

5:30our destination.

5:32And any lost data is retransmitted.

5:37So again we have this guarantee of delivery.

5:44Now with UDP or connectionless connectivity we don't have any guarantee of that

5:49data being

5:50delivered.

5:51And now with no guarantee that the data is being received in certain order.

5:56And we also have no retransmissions.

5:59Now later in the course we'll dive a lot deeper into TCP and UDP.

6:05But to give you an analogy here let's say when they send a letter to KIF.

6:10So we have two options.

6:13I can send this as registered mail.

6:19Meaning when I go to the post office I get a receipt that allows me to track

6:22that package

6:23until it gets to its destination that being keys home.

6:27When this letter is delivered to keys home he has to sign for it.

6:30Therefore confirming delivery.

6:32So this is like TCP.

6:35Or I can just drop it in my mail box.

6:40And here I have no tracking, I have no guarantee.

6:43I just hope that it arrives to keys house.

6:46In fact, KIF will never have to sign for this postcard.

6:49Therefore I will never have confirmed delivery.

6:51So this is like UDP.

6:54And we think to yourself, whatever use UDP that was the purpose.

6:58We have some protocols in application.

7:01What they preference is for a fast connection where occasional packet loss is

7:04acceptable.

7:05So one big one being voice over IP.

7:10Especially when you come to the audio portion of the conversation.

7:14So I'm talking to KIF on the phone when we're having a conversation.

7:17And we're doing so over UDP.

7:21And if the occasional word drops out that's okay.

7:23Me and KIF should be able to make out what we're trying to tell each other.

7:27But in the event that this was TCP.

7:32At that point during the conversation many packets are being lost or have to be

7:36resent.

7:36At that point that will result in choppy conversations.

7:39Why because we're TCP we're waiting for those missing packets to be re

7:43transmitted

7:43before playing the audio.

7:46This is the reason why some protocols prefer UDP over TCP.

7:52So going back to a transport layer and the PDU or protocol data unit.

7:56We're doing TCP is called a segment.

7:58We're doing UDP then it's called a data grant.

8:02And here at the transport layer we're adding source along with destination port

8:09numbers.

8:09All right next we have our network layer and here this layer determines the

8:15path that

8:15data should take through our network.

8:17Or in other words what is data that need to go.

8:22At the network layer we have the protocol IP and here a PDU is now a packet.

8:28And here we're adding source and destination IP addresses.

8:34All right next we have our daily layer and here we have a connect which is a

8:40data link

8:41layer protocol.

8:42That's what they find the frame format frame being the PDU here at this layer.

8:47Also they find the MAC address along with error tricking and rules.

8:51So a lot of local network communication.

8:55So here we're dealing with source in destination MAC addresses.

9:01We also have ARP here which is the address resolution protocol.

9:06And here we're mapping an IP address to a MAC address.

9:10When we have a device that wants to send data to an IP address on the local

9:14area network

9:15that device needs the MAC address with the destination.

9:19And it gets this MAC address from the IP address by sending an ARP request

9:24which is really

9:24our broadcast and receiving back an ARP reply.

9:28So we'll definitely see ARP in action later in the course.

9:31Then we have the physical layer which is the bits on the wire.

9:34So here we're converting the frames into physical signals like electricity,

9:40light or

9:42radio.

9:44So here we're actually sending the raw data, the zeros and ones over some type

9:50of medium.

9:51So cables, fiber optics for example or radio waves.

9:56So in doing so is carrying our data as signals.

9:59So we're converting our frames into raw signals or bits.

10:04The eventually when the data gets to a destination it will convert those raw

10:09signals, those bits

10:10back into frames.

10:13So in this video we spent some time looking at the TCP/IP model.

10:16And when what Eastlayer does, what it's responsible for and what type of PDU is

10:20you

10:20will see Eastlayer will definitely make our lives easier when we're looking at

10:24packet

10:24captures.

10:25The unifalling video will look at an example of encapsulation and decapsulation

10:30.

10:30[BLANK_AUDIO]

0:00You may have seen these toys called Russian dolls.

0:02You take a smaller doll, then put it into a bigger doll,

0:05then you take that doll,

0:07and put it into a bigger doll, and so on,

0:09until eventually you get one big doll.

0:11It's kind of like how encapsulation works.

0:14Each layer of the TCP/IP model or a side model

0:17adds a header to the original data.

0:19Then using our analogy, at the physical layer,

0:22the biggest doll that contains all the smaller dolls

0:25is the data that has to be transmitted.

0:26So when our data gets to a destination,

0:29all the different layers are removed layer by layer

0:31until we get to the original data.

0:33So in this video, we'll go over a few examples

0:35of encapsulation and decapsulation of data.

0:39For first, let me take you to a quick video.

0:42So in the event you haven't seen these dolls before,

0:44that's one big doll that she's taken apart.

0:47And we see within there,

0:49we have smaller individual dolls,

0:51until eventually we get to the smallest doll in the stack,

0:55which should be right here somewhere,

0:57and there we go.

0:59So again, pretty cool if you've seen that in person.

1:02So encapsulation and decapsulation

1:05is how data is packaged for transmission,

1:07and then later unpacked when it gets to a destination.

1:11So encapsulation, we are wrapping that user data,

1:15maybe that ACTP request that we spoke about earlier,

1:18with certain protocol and specific headers,

1:21as that data passes the different layers

1:23of the OSI or TCP/IP model.

1:26So here we're preparing that data for transmission.

1:29Eventually that data will get to a destination,

1:31where it has to go through a process of decapsulation,

1:35and here we are removing those protocol headers,

1:38as it goes through different layers of the OSI model,

1:40or TCP/IP model,

1:42which eventually will reveal the original data.

1:45So when we have encapsulation,

1:50we're moving down the stack.

1:56And then when we have decapsulation,

1:58for that point we're moving up the stack.

2:03So in fact, let's go ahead and walk through our scenario.

2:08I said James opens up a webpage in his browser.

2:11Here we're going down the stack,

2:13meaning that we are encapsulating the data for transmission.

2:17Meaning we're going through a process of encapsulation

2:19so we can transmit this data.

2:22So via the browser, James, issues the HTTP request.

2:26So here we have a raw data from the web browser.

2:29So next we go to our transport layer.

2:32As we're using TCP, we have a segment here.

2:37And with an asset, we have a source port,

2:39in this case 49321,

2:42where the destination port of port 80.

2:44As we move to our network layer,

2:47now we have a packet, and that packet

2:50now has a source IP address, which is right here,

2:53along with our destination of that website.

2:56I'll keep in mind this is a high level example,

3:00to show you the process of encapsulation and decapsulation.

3:04In the production environment,

3:05we definitely have additional steps like DNS,

3:08along with routing decisions,

3:10and also possibly encryption.

3:12So again, this is only a high level example.

3:15Right next, we go to a data link,

3:18which now we have a frame,

3:20and that frame has a source MAC address,

3:23along with a destination MAC, that being the laptop.

3:25So in this case, we're assuming that this website

3:28is not internal to us, it's somewhere on the internet,

3:32so our next hub would be the MAC address of our router.

3:34Then finally, we get down to the physical layer,

3:38and here we're sending binary signals over a medium,

3:41in this case, could be your ethernet cable,

3:43and these signals will carry our data

3:46over to our destination.

3:48So that's our encapsulation.

3:50So in this scenario, James opened up a web browser,

3:53and he's expecting some data to show up within that browser,

3:56either text or images or files.

3:58So imagine if you will,

4:00if James got an answer back on our web server.

4:02So at this point, we have to go

4:06to the decapsulation process.

4:09So here we have bits,

4:10so we have the incoming signals that are being received.

4:15At that point, at the data link layer, our network card,

4:18we group those bits into a frame.

4:19Then at the network level,

4:23the router information is processed,

4:25and it's determined our destination,

4:28in James PC or web browser, at his IP address.

4:31Then at the transfer layer,

4:34we see that the destination port is this 49,321,

4:39which is on the other slide with the source port

4:42that James defined.

4:45Then at that point, the HTTP content on the web page

4:47is delivered to James browser.

4:50So in this scenario, we saw encapsulation and decapsulation.

4:53Here we have a different view of it.

4:57Originally, we have our data at the application layer.

5:00Then eventually, we have our transport layer

5:03that adds the TCP/OUDP header.

5:06So again, some of the information here,

5:07source port and destination port.

5:09Then at the network layer, we add the IP header,

5:14which has a source and destination IP address.

5:17They eventually get to the data link layer here,

5:19where we have an ethernet frame.

5:23So here we have a source and destination MAC address.

5:25All right, let's go to one more example.

5:29So once again, at the application level, we have our data.

5:33At the transport layer, we add the TCP header, in this case.

5:38Keep in mind, it's also could be UDP,

5:41but here we're adding the source port and destination port.

5:44At the network layer, we add the IP header,

5:47which includes the source and destination IP address.

5:50And then at the data link layer,

5:53we add the frame header and the frame footer.

5:55So here in our frame header,

5:58we see our source in destination MAC address.

6:03And here at the frame footer,

6:06sometimes you'll see documentation that refers to footer as trailer.

6:11But the frame footer or trailer will include a frame check sequence.

6:15Also abbreviated as FCS,

6:18but this will include a CRC,

6:20which stands for cyclic redundancy check,

6:24but the CRC is used to calculate the value

6:27based on the entire frame contents.

6:29So what occurs here is when the destination receives this data,

6:36they will recompute or recalculate the CRC

6:41to ensure that the value matches.

6:44In the event, there is no match from that CRC value.

6:47At that point, their frame is considered corrupted and therefore discarded.

6:50Then after a data link layer,

6:54their frame is sent over to the physical layer,

6:56where those frames are converted into physical signals,

6:59and that points sent over to the destination.

7:02So you see here, you see example with TCP header,

7:05but in the event that we had UDP traffic,

7:07the expectation would be to see UDP headers.

7:10So in this video, we saw the encapsulation and decapsulation of data.

7:15This is done so we can transmit this data over a network

7:19to eventually get to the destination,

7:21but they were decapsulated data,

7:23so removing its layer until they get to the original data that was sent.

7:28[BLANK_AUDIO]

0:00WordShark indeed is a great tool for capturing traffic.

0:02These captures are only useful if you can go back and view them later or share

0:06them with someone else.

0:07So in this video we'll see how we can handle our files within WordShark and it

0:11's for specific data we needed.

0:13So here we are, our lab environment that we'll spend a lot of time in.

0:18So here I'm going to do is give myself more real estate. I'm going to minimize

0:21this section here.

0:23So at this point I'm going to open client nug.

0:28All right we'll go ahead and maximize that screen there.

0:32Here with the next lab we have two options to open up WordShark.

0:37So here we have a regular shortcut that will open up WordShark in dark mode

0:41or we have a different shortcut here that will open up in light mode.

0:44So again the preference is yours.

0:46All right we're going to use light mode here.

0:49All right and here we have our WordShark application.

0:56I'm going to do is go to file and go to open.

0:59Then here on our desktop we have a folder called packet captures that you can

1:06also add tests.

1:06And if I'm going to open is this HTTP PCP 80.

1:11So here I can choose open. I want to show you light use cancel here and in the

1:16event that we've

1:18viewed this packet capture before we also can open the file right here.

1:23Or for now let's go to file open and open that file that we mentioned.

1:27Choose open once again.

1:28You have a packet capture that we saved seriously.

1:32Before we go over how to open save and export certain data within a capture

1:38let's go over the different elements within WordShark.

1:41So first we have our title bar and here we can see the name of the packet

1:45capture file

1:46that we currently have open.

1:47We also have a test based menu right here.

1:52We also have a main toolbar here with all the different icons.

1:55We also have our filter toolbar right here that we can use

1:59to really narrow down the packets of interest within this capture.

2:03Here we have our packet list pane which shows us different roles of capture

2:09frames

2:10with basic information like source and destination the protocol being used.

2:14Now that we can remove add every all these columns as we see fit.

2:20If we pick a packet here we have our packet detail pane

2:24that will give us detailed information about the different protocols and

2:28protocol fields.

2:29We also have a pane that's currently hidden.

2:32If I go to view I'm going to packet bytes and we drag this over we'll see it

2:39right here.

2:39Here we have additional data about this packet capture

2:43but this data is in role as a decimal and ASCII format.

2:49So in fact let me expand this a little bit more and we drag this over to the

2:53middle.

2:54So to the left here is our data and it has a decimal format

3:01and to the right here is our same data but in ASCII format.

3:05And this pane is useful in the event that you want to see the exact bytes that

3:10went over the network.

3:11All right let me go ahead and hide that for now.

3:15We'll view an unshred packet byte and here to the bottom we have our status bar

3:22.

3:22So we can see here that this packet capture has 12 packets as far as profile

3:26that we're using.

3:27Currently is our default and also the name of the capture right here.

3:32You and I will spend a lot of time with the maris shark and this is just an

3:35intro of the

3:36different elements within the GUI interface.

3:38With the maris shark we have the ability to perform a live capture.

3:44You and I will definitely do that in a later video.

3:46We also have the ability to read from a file.

3:50In fact that's what you and I have done here.

3:54We went to file and to open and at this point you the packet capture that we

4:00want to open.

4:00We also have the ability to drag your packet capture into our shark.

4:04Let's go ahead and minimize that and now drag it to the right.

4:08Let's open this folder called packet captures on our desktop.

4:12What we're going to do here is take a different packet capture, drag it over to

4:16our shark

4:17and drop it and now we see that we have that packet capture open within the

4:21water shark application.

4:23Water shark has two native file formats.

4:26So you'll see PCAP and you also see PCAP and G which stands for next generation

4:35.

4:37So again these are the two native file formats to water shark.

4:40With PCAP and G being the water shark default file format.

4:44And later we dive deeper into the differences of both file formats.

4:49So let's take a road trip over to some water shark documentation.

4:54So what I'm going to go is to wire shark.org/docs

5:00and here to the very bottom we'll see a section here for documentation for

5:04users guide.

5:06Wire shark does give us the ability to consume this guide either online or

5:10offline.

5:10We're going to do choose PDF here.

5:14Let's go to page 73.

5:19We have a section here for open capture files.

5:23We're going to scroll down a little bit more.

5:25And here we see a section for input file formats.

5:30And here we have our two native formats right here.

5:33PCAP and PCAP and G.

5:35But we want to show you here that water shark can open up formats from

5:39different capturing tools.

5:41So we can see here that water shark does have the ability to open many

5:46different types of files

5:48within water shark.

5:48All right going back to our lab.

5:51Let's say we want to go to the process of saving a file.

5:55So here I can go to file and go to save as.

6:00If you have to pick our location so if I go to administrator here for example I

6:04can choose

6:05desktop.

6:06So for file name I'll give it test.

6:08So we can see our default here or PCAP and G.

6:12But we also have the option to save it as a different format.

6:15All right so we'll keep our default.

6:18Let me resize this window.

6:21And here to the bottom we have our compression options.

6:25So here our default is uncompressed.

6:28So here we're not using any compression whatsoever.

6:31So you would choose this option when this space is not an issue.

6:35Or maybe you're sharing this packet capture with someone else who may be using

6:39a different

6:39tool other than water shark and you want to guarantee readability of this

6:43packet capture.

6:45One compress will give you a larger file size.

6:50Another option here is compression with G zip.

6:56So here we're saving this space.

6:58This type of compression is compatible with many tools other than water shark.

7:04There is sometimes a compressed and decompressed packet capture especially for

7:09those large packet

7:10captures.

7:10Or maybe you're emailing this to a colleague and we're forced to compress the

7:16file.

7:16The packet capture file is small enough to transfer over email.

7:20We also have compressed with LZ4.

7:25LZ4 compression is very fast and very modern.

7:27So it's faster than G zip.

7:30It does have a very good compression.

7:35Therefore the packet capture files are smaller than uncompressed but still not

7:39as small as G zip.

7:40And any bandwidth sharing this file with someone who is not using water shark.

7:45We have to ensure that their tool wherever they're using supports this type of

7:49compression.

7:51So in fact I've tested this out. I'm going to do here a star packet capture.

7:55And no worries we'll go over this process in great detail in a future video.

7:59But just to start this process I'm going to pick the appropriate network card

8:04right here.

8:05We'll choose start.

8:06Alright so at this point I'll wait a minute or two to collect enough packets.

8:13Now to the very bottom here we see that the packet count is increasing.

8:20You also see their live capture is in process.

8:23Then in the title bar we see the network card that we're capturing traffic from

8:27.

8:27So I'm going to stop it here. We have about 2200 packets.

8:33I'm going to do is go to file. Go to save as.

8:37I want to go to my desktop here.

8:40I'm going to call this uncompressed.

8:46If we're doing so we'll make a new folder or this test.

8:50Let's go inside test and we'll save it.

8:52Alright we're going to go to file and save as once again.

8:57But this time I'm going to name it compress dash gzip.

9:01And let me go ahead and choose that option there and then hit save.

9:07Let's go ahead and go back and open up the uncompressed version.

9:16We'll do file and save as.

9:18And this time we'll choose that third option.

9:20Compressed with lz4.

9:24We'll do name compress lz4.

9:28Hit save.

9:29Do not go to that folder.

9:31Let's go to the desktop here.

9:34Go to test.

9:37And here we can see the differences in file sizes.

9:40Keep in mind I did this for a small sample.

9:44Meaning that this was not a large packet capture.

9:46So for uncompressed we see the size being 268 kilobytes.

9:51We do see with gzip compression

9:56that our file size went down to 35 kilobytes.

10:00When using lz4 compression we definitely see the file decreasing size down to

10:0654 kilobytes

10:08but not as small as gzip.

10:09Alright so we're going back to our packet capture.

10:12There are times where we want to export certain packets within that capture.

10:16So let's say we want to focus on only DNS packets.

10:20Now later we'll cover display filters.

10:23But one of them is one called DNS.

10:27Sorry about that color there it's kind of hard to see but if I hit enter here.

10:30For now our takeaway is that we're now focusing on DNS packets.

10:34So in fact now on our status bar we have a total of 2187 packets

10:41but now we're only showing 1800 that are related to DNS.

10:44So let's say we were having DNS issues and I want to show you this packet

10:50capture

10:50we're keeping.

10:50So what I can do here is go to file

10:53then go down to this option "Export Specified Packets".

10:58Let me go ahead and resize this window.

11:01So our default is to save all packets.

11:07But now we have two radio buttons here.

11:09One "Capture" which means if I select this all 2187 packets will be saved.

11:16Or again only export those packets that are currently being displayed.

11:20In this case 1800.

11:22Also have the option to only export those packets to I select.

11:27Let me hit cancel here and let's say I marked these packets right here.

11:35Alright so there we have 1, 2, 3, 4, 5 packets.

11:38We'll file go to export specified packets.

11:42I'll resize this window once again.

11:43And now I have to select this option here.

11:48At this point it will export those five packets and those five packets only.

11:52We also have the option here for marked packets.

11:55So once again I'll choose cancel here and let's say this packet here was a

12:01interest. So I can do a right click here.

12:05Let's say this other packet here.

12:08Let me pick a random one right there.

12:10It's also of interest.

12:12So I can right click here and also go to mark.

12:15So now I go to file and go back to "Export Specified Packets".

12:19And look at our options now.

12:21You saw me mark two packets.

12:26So indeed when I chose the option there I have the ability to only export those

12:31two

12:31packets. We also have the option first to last mark.

12:35And what this would do is go ahead and save all the packets

12:40between the first and last packet that I marked in this case 53.

12:43Also I have the ability to pick a ranger packet.

12:46So when I export it will be packaged 51 through 200.

12:50Also I have the option to remove any ignore packets.

12:54So I also have the ability here to ignore a packet.

12:58So let me go a little bit higher.

13:00Choose this one.

13:00Choose ignore.

13:02Alright and the bottom here we see some packets remarked.

13:05So I'm going to ignore.

13:06So at this point I go back to export specified packets.

13:10And let me resize that window once again.

13:13So here we see a corner one for ignore packets.

13:16And the reason it's not in the display column is once I ignore a packet

13:21it still is this within a packet capture.

13:24But that packet is no longer displayed in this packetless pane.

13:28In fact I got a caption here.

13:30We now see the ability to remove ignore packets.

13:33Alright so going back to the displayed here.

13:35They may have found an option here.

13:39Include dependent upon packets.

13:41So I'd say that we have related packets like TCP handshakes or maybe fragments.

13:47These packets will also be included in the event.

13:49The packets that were currently exporting depend on them.

13:53This helps us avoid exporting incomplete traffic flows.

13:58Alright so we'll name this specific packets.

14:00So we see a count here 1,799.

14:04That was 1800 until we ignore the packet.

14:07That's for going ahead save.

14:09Alright now let's go ahead and close our chart.

14:12We see our file that we just saved specific packets.

14:17Let's open up our chart.

14:18So in fact we'll go ahead and open it right from here.

14:21And there we go.

14:23Now we have a capture file.

14:26That only includes those packets that we exported.

14:28Now finally if we do a file we add the option to the close or quit.

14:34So what close does is it closes to currently open capture file or live capture

14:41window.

14:41But we can see that the wire shark remains to be open.

14:44We'll write it to open our file once again and go to file and quit.

14:50So now that we're closing the file we're also editing the entire wire shark

14:56application.

14:56So in this video we wanted a process of opening,

15:00saving and closing files within wire shark.

15:02And also exporting certain packets of interest within the wire shark

15:06application.

0:00Not all packet captures are created equal.

0:02In this video, we'll break down the differences between PCAP and PCAP and G,

0:05so you know which one to use and why it matters.

0:08So PCAP stands for packet capture.

0:11And this was the original simple file format that was used for packet captures.

0:16So our PCAP file stores network packets as flat records,

0:21meaning that each packet is written sequentially one after the other.

0:27And also each packet is self contained.

0:30Meaning that everything needed to describe the single packet is stored inside

0:36the record itself.

0:37So again, a PCAP file stores network packets as flat records with basic

0:41metadata,

0:42for example, timestamp, packet link, and a packet data itself.

0:46And the metadata is important, especially when trying to understand

0:51the actual packet capture, for example, when and where something occurred,

0:56without needing to decode every single byte of information or raw data.

1:00PCAP format does not support any information about the capture source.

1:05For example, here we're talking about the system that took the packet capture,

1:09along with interface or any annotating packets.

1:13So here we're talking about adding notes or comments to the packets

1:18within our packet capture that can be viewed later by us or someone else.

1:23And the PCAP format is widely supported across different tools,

1:27other than water shark.

1:29And it's really good for smaller captures or really not designed for extens

1:33ibility or very large files.

1:35And also all packets in the PCAP file are assumed to come from a single link

1:43layer type.

1:43So meaning that all packets either came from the ethernet type or from Wi-Fi.

1:53So with the PCAP format, we could emit captures from both the ethernet and

1:59wireless adapter in the same file.

2:01So a PCAP NG, NG stands for next generation.

2:09And this was designed to address the PCAP file format limitation.

2:14So here we can allow packets to be captured from multiple interfaces or link

2:19layer types

2:20in a single file. So again, both ethernet and wireless for example.

2:24It also supports storm and extensive metadata.

2:28So here we can include details like interface descriptions or comments or

2:34annotations made to

2:35packets along with encryption keys. But this is only some examples of the

2:39additional metadata

2:40that we can obtain with the PCAP NG format.

2:45And this format became wire shark's default since version 1.8. We can see here

2:50by the year 2012 has

2:52been a long time. So in the event we're looking to obtain a basic packet

2:58capture or that capture

2:59to be compatible with all the tools, at that point we would go with the PCAP

3:03format.

3:04But in the event we want that advanced analysis, especially if our networks are

3:09complex and we need

3:10that additional detail, at that point we will go with PCAP NG. All right, so

3:15let's go over to our lab.

3:16All right, we're just right here. All right, so let me get rid of these right

3:21here. Let's open up

3:23our uncompressed. We can see by the title bar, this is saying it as a PCAP NG.

3:29I'm going to do

3:30this go file, save as I want to save it as PCAP. And we'll name this uncomp

3:36ressed. PCAP.

3:39And then hit save. So now I'm going to show you the difference between PCAP and

3:44PCAP NG.

3:44So if we go to statistics here, go to capture file properties. I'm going to

3:51open up a second

3:52wire shark window here. Let's go to file and to open. I'm going to open the

4:01original uncompressed

4:02PCAP NG. Choose open there. We'll go to the same place, statistics and capture

4:08file properties.

4:09What I want to do is put these two windows side by side. And here we'll see

4:15some of the major

4:16differences. So on the left here we have PCAP format. And then the right here

4:22we have PCAP NG.

4:26So our file size for PCAP is 233 kilobytes. And the right is 273.

4:31The PCAP NG file is larger due to the extra metadata.

4:37Now for PCAP we have no information about the capture device. In fact, we see

4:44here unknown.

4:44For PCAP NG, we see the hardware, the operating system, and also the version of

4:51our shark.

4:53This information is great, especially if this system is having the issue and

4:57you want to

4:58duplicate this environment for testing purposes. So here for interfaces, we

5:03have unknown.

5:03But for PCAP NG, you see the name of the interface. We also see drop packets at

5:110%.

5:12For this information unknown for our PCAP file.

5:15So we definitely can see some of the differences between the two file formats.

5:20In fact, let me go back to the PCAP NG file. Let me close this, close this.

5:27So we have a file right here. Let's say about to comment on this file.

5:31So packet comments, add new comment. This is a test. All right, with that in

5:38place, I will hit OK.

5:39So we can see the packet comment right there. I'm going to do a save as once

5:44again.

5:45So this time, I'll name this test one dash PCAP NG, hit save,

5:51I'll do a save as once again, but this time we'll save as PCAP. So test two

5:59dash PCAP hit save.

6:01We see a warning here. This file format you chose did not support comments.

6:06You want to say the packet capture in a format that does support comments.

6:10So we'll go ahead and choose this card comments and save.

6:13So now in this PCAP format, if we go to packet one, that comment is no longer

6:17there.

6:17But if I go back to the other one that we save,

6:20this test one PCAP NG, we see it does retain those comments.

6:26So in this video, we saw a difference between different capture file formats,

6:30really focusing on PCAP versus PCAP NG.

6:34We also went over the benefits. Now we know why the default for War Shark is to

6:41save the file

6:41format or capture file as PCAP NG or Net Generation.

0:00Good job, make it to the end of the skill.

0:02In this bad asian section, we're going to use your newly obtained knowledge to

0:06launch

0:06the lab environment and answer a few questions.

0:08Let's get started and dive in.

0:12So in this section, your tasks include launching the lab link below, which we

0:16see right here.

0:18Then navigate into the client structure cut on the desktop.

0:21And on the desktop, we want to go to a folder called package capture, then

0:25launch this file

0:27right here.

0:28All right, so I do have his lab already running.

0:31So let me close his lab panel right there.

0:34Let's go to client nug.

0:35All right.

0:37So on the desktop here, we have a folder called package captures.

0:40It will open it up.

0:42Now at this point, we want to open up this file right here.

0:46All right.

0:47So let's see where our first question is.

0:50You'll be screw down a bit.

0:53And the wire search status bar, how many packets are in this capture file?

0:58All right, going back to our lab.

1:00All right.

1:01So our status bar is right down here.

1:05We can see that we have a total of 43 packets.

1:07All right.

1:08So going back to our question, we'll go ahead and choose 43 and submit going to

1:15question

1:16number two, but that file is still open.

1:19We want to go to statistics capture file properties, what operating system was

1:24a capture device

1:25running?

1:26All right.

1:27So let's go ahead and check that out.

1:29So we're going to go to statistics capture for properties.

1:35We can see he had the bare running 64 bit version of Windows 11.

1:39All right.

1:40So let's go back to our question.

1:41We'll go ahead and choose that as a correct answer and hit submit.

1:45All right.

1:47So we're going to go ahead and select the number three, and then we're going to

1:52go ahead

1:54and select the number three.

1:55All right.

1:56So we're going to go ahead and select the number three, and then we're going to

2:00go ahead

2:01and select the number three, and then we're going to select the number three,

2:07and then

2:08we're going to select the number three, and then we're going to select the

2:10number three

2:11and then we're going to select the number three, and then we're going to select

2:15the number

2:16three, and then we're going to select the number three, and then we're going to

2:21select

2:21the number three, and then we're going to select the number three, and then we

2:25're going

2:26to select the number three, and then we're going to select the number three,

2:29and then

2:30we're going to select the number three, and then we're going to select the

2:32number three,

2:35and then we're going to select the number three, and then we're going to select

2:39the number

2:39three, and then we're going to select the number three, and then we're going to

2:44select

2:44the number three, and then we're going to select the number three, and then we

2:51're going

2:51to select the number three, and then we're going to select the number three,

2:56and then

2:56we're going to select the number three, and then we're going to select the

3:00number three,

3:01and then we're going to select the number three, and then we're going to select

3:04the number

3:08three, and then we're going to select the number three, and then we're going to

3:12select

3:12the number three, and then we're going to select the number three, and then we

3:17're going to

3:17select the number three, and then we're going to select the number three, and

3:20then we're

3:20going to select the number three, and then we're going to select the number

3:22three, and