Ok, welcome to configuring your PC.
So as we download and install Wireshark,
there are a couple of things
we need to do on the PC.
We're going to talk about placement again.
This will be a brief module.
We just want to make sure that
before you start using Wireshark,
there's some specific things that you do
so that you're not in a situation where
you're, you're capturing data but
you're not in the right segment
or you're capturing data and your
machine's going to crash.
Sure, you haven't, you know,
placed things correctly.
You haven't downloaded the correct plug ins.
So there's a few things that
we just want to go over to make sure that
before you get deep into, you know,
configuring Wireshark, you've absolutely
made sure that this basics have been covered.
So, when you set up your PC to capture traffic
now, whether you are actually getting it
from a mirror, a mirrored port or
you're capturing right off the promiscuos NIC,
you want to make sure that Wireshark
is installed and loaded and operating
on the target machine.
You want to make sure that the PC
is connected to the network correctly
and you are able to receive traffic
from your intended source.
So if you're setting up specific data
to be sent via a mirrored port,
you've done that correctly.
You're actually receiving that data.
You can see data accumulating in Wireshark
and you have set it up in a way where
it's not going to crash your machine and or,
you know, take over the resources of your
your target machine.
And again, make sure that you understand
specifically, you know,
where you're placing this thing.
Make sure that if you're going to use
Wireshark, ok, what am I, what am I,
what is my source? What is my destination?
Where am I looking to send data to and from?
What type of data do I want to see?
Where do I want to, where do I want to place
Wireshark, and when I placed Wireshark,
not only can it collect data so I can filter on it,
but I just want make sure that specifically,
I'm on one side of a firewall if I need to be
and will I allow the traffic through it.
And when we do this, specifically,
with the port mirror, one of the key things
that we want to make sure that we do
is we want to make sure that
we're capturing traffic from the intended source.
So, with the Cisco switch,
we're going to set up a monitor session.
And the first things that we do when we set up
what we normally call span session is
we want to make sure that there is no other
span sessions running.
So we want to make sure that
we run a no monitor session all, and we cancel
out everything that may be configured.
The next thing we want to do
is we want to set up a new monitor session.
And we want to set up specifically
what the source and the destination is.
Now this doesn't necessarily map
to the source and destination information
that we were talking about
when we were laying out where we're sending
data to and from on the network
and where could the potential problem be.
This is specific to the switch itself.
So what this means is, ok -
I have an open port on my Cisco switch
and one of the things that I want to do
is I want to make sure that I have the data
coming from the specific computer with,
that I want to capture sent to that open port.
So the source is going to be where
I want to capture the data from
and specifically the destination is
where do I want to set up the data to.
So if you're thinking this correctly
the destination would be
the system with Wireshark.
And again, just make sure that if
you know, if you're going to do something locally
you want to make sure your system is mobile.
You know, generally, we try not to
impact the clients we're helping.
So if you have a system on a network,
it's having an issue
and having an application issue, the last thing
I want to do is I want to get in front of them.
I want to try to, ok get, you know,
let me get Wireshark installed.
It might be easier if you set up the span session
and you're able to get the data sent
from one location to the other
so you're not impacting them
which actually makes it a lot easier.
You could set this up remotely.
You can have someone from desktop
maybe help you set up a laptop with
Wireshark span a port.
Go, have the, this is if you're doing it remotely,
have the, the field service's agent go out
to help the customer.
Ask him, ok, I see you have that issue -
can you do that particular, you know,
access to data or that that application
you know, movement that you're doing
and be on the phone with the network engineer
or net, network analyst and say,
alright you're running a capture,
yeah, they're doing that now.
And you could see this live
if you're already feed into the machine
or just capturing the data.
And you know, you'll analyze it later.
But that's a really good way to capture
your data remotely and not necessarily
have to go onsite specifically to capture it.
So that might be one way that you want to
place your PC or your mobile device and
you also want to make sure
that you're selecting the correct NIC.
So one of the, the tricky things now, today
with almost every device
having a wireless connection on it
and a, a landline, is that you want to
make sure that if you're capturing a problem
that you take both interfaces
and all interfaces into account.
So as an example, we have epN interfaces.
So when you build a virtual interface,
it shows up. We might have a VMware installed
where it creates a whole series of interfaces.
We might have a loop back installed
even locally on a PC.
We might have a wireless connection.
We might have 2 or 3 NIC card
connections configured. When you go to select
an interface and we'll talk about this
when we talk about launch pad,
when we actually get right into using Wireshark,
is that you have to actually select the correct
interface to capture data from.
And you may not know what that is without
getting into Wireshark and looking at it
and seeing what activity is taking place.
So, we'll talk about that when
we talk about the interfaces.
But when you're ready to select interface,
you want to make sure it's a live interface.
You want to make sure it's the right interface.
You want to make sure that it's the interface
that you intend to use to collect
the correct data because you may different
interfaces on different segments.