Ok, welcome back everybody
and we're going to get into some
configuration of Wireshark.
We will get very deeply within
the configuration of Wireshark because
there's a tremendous amount of
things that you can do particularly
when we get into the preferences
in setting up profiles.
One of the most important things
for that is you may want to troubleshoot
something rather quickly
and you may find that, you know,
you want to try to solve,
let's say, a wireless, wireless issue.
Instead of going in and configuring all that stuff
you could set up a particular profile
or preference systems,
so that when you load Wireshark,
you can just drop in that profile
and you'll have everything ready to go.
So, that's essentially one of the reasons
why it's so important to, to get in there,
and, and really learn the nuts and bolts of it.
Alright, so before we begin,
there's a couple of questions in the chatroom.
One of the questions I saw
as I'm pulling this one up now,
is, "Will we cover Lua processing?"
Yes, we will cover that.
Also, what I wanted to ask everybody is,
if you have any questions about things that
aren't particularly covered,
go ahead and ask them in the forum,
and we will get to that information.
Alright, one of the questions I see here,
"Is Wireshark stable with the Linux server?"
So, actually yes, it's very stable.
I have Wireshark here on a Linux server.
I have it on right now.
I could pull this up and show you.
But particularly, one of the things that I see
with Wireshark is that since it's open source
in it's open source community,
a lot of what we see with Wireshark
in particular is that it's most stable
on Linux systems. But it's, it's just as stable
on the Windows systems as well.
So, it's really stable on both.
And I'm going to pull it up for you
to see as soon as it loads
but that was one of the questions. Alright,
so let me take a look at another set here.
Ok, ok so, a couple questions about
the advanced stuff. The advanced stuff is
coming up in future modules.
It's a 3-day course so obviously
we got to get some information, you know,
tee you first on how to install it,
configure it, getting it up and running.
It's a foundational course
so we will definitely go into some
some deep diving but this was a course
offered to all so that people who have
used Wireshark briefly and those
who are learning to learn more,
looking to learn more information about it -
we will definitely get into some more
specifics as we go along. Alright,
so I'm going to draw up on the screen
very quickly, having it running on a VM but
you definitely have Wireshark.
I'm using one to backtrack right now,
so, let me post up for you.
So, it's just as stable as if you're going to
use it with the Windows, so
we will definitely field some more questions
about that as I see more coming into the chats.
Alright, so keep the questions coming
and let's go into the next module.
Alright, configuring wireshark -
Now some of these may seem rudimentary
but in actuality, it's really one of the most
important things about using Wireshark is -
Do I know how to use it correctly?
Do I know what I'm filtering for?
Do I know protocol behavior? Have I,
do I have the correct layout and the tools
available to me to be able
to troubleshoot traffic?
So essentially, when you configure
Wireshark for use for the first time,
one of the key things that you want to
do is you want to make sure that
you understand what preferences are.
You understand what, how to change profiles.
You want to understand the basics of
filtering which we'll have a whole module on.
And the basic layout of it so when you
first open it, you're going to have this start page.
I like to call it the launch pad 'cause it's
basically where you're going to launch.
The actual capture window from
that particular launch pad or that start page
newer with newer versions of Wireshark;
older versions, just load it right into
the capture window, that has it's own
set of specifics you have to work through.
Such as selecting an interface,
you could set up pre-capture rules
which are very different from display filter.
So a capture filter is different than display filter.
And you can do those on
and from the launch pad.
And what interface to select which
we started talking about in the last module,
where you have to know specifically what mod-,
what interface it is that you want to use.
So, what's the overall layout of Wireshark?
Very quickly, we just highlighted it.
When you load Wireshark,
you're going to have a launchpad.
You're going to be able to select an interface.
That will allow you to choose a LAN adapter,
or a wireless LAN adapter.
There are other adapters.
We already talked about them.
We have some virtual adapters. And
you'll be able to pre-configure adapter behaviors.
So what does this really mean?
So, when you want to configure your,
your interface, you're going to see that there's
multiple interfaces that you could choose from.
Now, yeah, you could hide some of these
and you can make them disappear
so that you don't see them here.
Some, often people do that with bluetooth,
or some of their VM ware interfaces,
they want to just, kind of, you know,
they don't want to see them.
But again, what you could do,
you can hide them, and or
you could set up specifically
when you launch in configuration files,
you can limit this list.
Now, when you do want to select the interface,
you have options in which you can select
from when selecting interface.
So if you're going to select, let's say
a LAN interface, you can check
the health of your adapter.
Make sure it's passing traffic
right from the options, and the reason
you want to do this is because
it's going to help you select the interface.
It might show the IP address configured.
So if you have, let's say,
3 network adapters configured on 3 different
let's say, 3 different IP addresses and
you want to troubleshoot
something on, let's say, 10.1.1.X/24
you want to find an interface configured
on that subnet so that you can
capture data within that subnet.
And you know that you're doing the right,
you're on the right path.
There's also a lot of statistics
that you can review when you
open the sub so that you can see
particularly on this interface - I am connected,
what's the link speed, am I passing traffic,
how much traffic? And, and specifically,
you know, data revolving around that interface.
So it's very important to consider the interfaces
before you launch a Wireshark capture.
It's going to basically predetermine everything
that it is that you want to see from the interface.
So it you don't have the correct interface
you're not going to be able to capture data.
You may get,
you may choose the wrong interface,
collect the wrong capture information.
And you'll be able to see
specifically the link status.
When you finalize your selection,
you want to just do your final prep.
Load the adapter and begin your capture.