Hello everyone and welcome to another video of course in this studio we are going to talk a bit more
about Warszawa display filters.
And once we get a basic understanding of our it don't work we'll move to them with exercises where we
can start working with catching brackets and applying those filters.
So what exactly is a sharp display for readers.
So filters lets you look at specific traffic.
For example if you only want to look at all the DNS requests that you have made and you don't want to
look at the speed requests you can apply a DNS filter so that wireshark will only show you all the DNS
traffic that has been captured for the game in session.
So this is what Phil does does for you it's basically post filters once you have the packet capture
you can apply those filters to that filter and reserved are if let's say you are only interested in
looking at live DNS requests and you can start a live capture.
You can apply the finger on Gyi will only show you the packets that gets matched video filters.
One thing to keep in mind is that the filters only filters out the traffic it doesn't delete the remaining
part of the remaining gap on the remaining Gotcher still remains.
It shows that the display filter kind of narrows down to the specific requests that you have made using
the filters so the slave traders have their own format and they're much more powerful than the capture
figures.
So in the previous video we saw their display for this location is in a new way.
So you can see that there will be a filter tap there you can just pro-white here and display and the
display panel here.
They basically list the result of the filter that you have up right.
So the most basic way is to just write the name of any protocol that you want to think.
For example if you want to look at DNS traffic you can just enter DNS and press enter an equal only
show you all the DNS requests that has been made by your machine.
Similarly you can boss DCP you can be and so on to look at specific captures of data
so wash or display has a very specific format here.
I have broken a filter into its specific sections.
So first you provide the protocol.
For example here I'm providing FGP and then you can put dark stupe on got a different string operations.
For example the string one is Bassi and string do is IP.
And then you can boss the combatives an operator.
What do you want to look at.
We want to look at specific IP.
Do you want to look at conditional matchin and things like that.
For example in this case I want to get a specific match for IP address and door to door 3.4.
And then you can further add logical operators and you can add medical expressions going forward.
You can either end right here and the value once you feel that okay this is the only data that you need
and this should be or figure.
For example let's say you only want to look at IP then do before then you could just have this much
data provided and you get your results and you can keep on expanding the filters by just gone Gatty
knitting.
Following this particular logic.
So this was how their display fingers are arranged by washer.
So if they figure that you have provided for example the speed or CT equals 100.
If this figure is correct and it will by sharp you can see that the bar turns to green color which means
that it's the correct index and if the bar remains as red in color it means that most inducts is wrong
and probably you might have to look for the right way off the writing filter.
So this is a very good indication right after the label itself that was pro-white too so that you don't
really have to run it and then wait for wrong results and then say that all you figure was wrong.
So it kind of runs a static check hid itself and it tells you whether your figure is correct or not.
So it's basically checking the Sendak's if your index is correct then it's obviously going to greet.
If this index is wrong it will.
Don't do it.
So here is a protip for you guys.
There is an excellent cheat sheet that has been created by Packard life darknet.
It has all the important why shot display filters in this one single PDA which you can obviously and
refer back whenever you are walking by a shark.
I have also attached this PDA as a resource for you with this video.
You can go to the resources section and you can download it from there.
And this this it is really really handy.
And we will be looking at some of the militias big gaps in the league of radios the other important
thing that I want to bring up is the follow stream option in Bosher.
So if let's say you are collecting a bunch of streams Let's say you are using your browser to visit
all kinds of sites and at a given time you will visit different websites.
If you look at the peak app it will have all the backers that have been captured at any given and do
with it will not have the serial capture display for example if you are visiting Google dot com and
at the same time you visit CNN.com as well.
Then Divakar gotcha.
We'll have all those placards displayed in all the random sequences there will be a request to Google
all of a sudden there will be a request to CNN and the responsible will to sponsor CNN and so on.
So what do you do if you let's say only want to look at the traffic that correlates with google.com.
That's where I follow APCP screen comes into picture.
So let's say you see that OK I have sent a request or will will not comment.
I want to see what the response came back.
You can just right click on it and you can go to follow stream and it will basically show you the entire
stream of data here the read mugged text is basically the request that you send and the blue part is
the response that you got back from the server.
So this is what follows stream helps you with that kind of aggregates the anti-ID communication into
a single window so that it becomes easy for you plan like that saving packet filters you can just click
on file and you can just click on Save as all you can exported into various different formats that are
supported by Wireshark and other packet capturing tools as well.
It's always advisable to keep a copy of your back at capture because this was an important and critical
evidence for your forensics and analysis work.
So there is another handy option in charcoal bartók start started sticks.
If you have a Packard captured with you you can just go to Russia statistics it gives you information
about what kind of packet has been captured by shark failed or nine you Randy Bakhit capture and tell
you how many DCB Packards were captured.
How many DNS requests were made.
And a lot of ones statistics as well which can be very helpful.
Then you are analyzing complex records or then you analyzing packages which are re-insurance size and
that is wash our statistics play a very critical role in giving us a rough idea about what kind of Bakhit
mostly contributes in the particular pick up flight.
Here is another view that you'll get and died a few graphs off here.
Now packet captures you can just go and launch by a shark and you can start playing with all these features
in marker.
So that's it for this video.
See you later the.