Ok, on our next module,
we will briefly go over window panes.
We started talking about it when we were
discussing navigating the GUI but particularly,
the 3 window panes that you will
be working mostly with.
So, to use Wireshark,
you're going to have to understand
the fundamentals of navigating this interface.
And particularly, beyond the dashboard
or the launchpad, the capture window itself,
you're going to have 3 major panes -
the packets list, the packet details and the bytes.
What's really important about this is
when you cover data or you're looking
at data that you captured, the main window
or the main pane you're going to look at
first and foremost is the, the packet list
because what you really need to do
is you really need to filter down
what you're trying to get to. Otherwise,
it's just going to be an entire mess of data
you're going to have to sort through
or scroll through and that's going to make
what's in the details pane less relevant to you.
So, essentially, yes there's a lot that
you can glean from the packets list, but
what you're really trying to get to is
some of the data in the details pane.
And if you're not really sure how to filter
your data out, you're just going to be
sifting for a needle in the haystack.
So, in this example we can see quite simply
that we have an ARP broadcast
It's telling a story here in the packet list panes.
So that's why I chose this specifically
for this, this screen shot is because
this is something that you really don't
need to go too deep into detail
in the details pane to see that there's
some kind of issue going on.
Again, you have to know how ARP operates,
and you have to know when
things kind of look wrong.
But this is basically a sweep or a broadcast
or some kind of issue where you have a
a bunch of NIC cards, basically ARPing out
to each other over and over, creating a storm.
So, this is one of those times where this pane
particularly can tell us story without
having to go too deep into the details.
So, in the packets, the packet list, basically
it's going to be captured in the order,
in order for review. Yes, you can merge
and things will be out of order if you don't
know how to merge correctly.
You can change the time stamps and
you could change some of the details
about the capture but essentially
it's going to show a number order -
packet 1 through X, how much data,
how many packets that were captured.
We'll show you how to get,
show you the summary of the capture
so that you could see exactly
how many packets were captured.
But particularly in this, this pane,
it will show you from 1 all the way down
every single packet that was captured
by Wireshark - the columns that you'll review
as the number, the number of the packet,
the time. Now, we have a whole module on time,
where we'll cover absolute, we'll cover relative,
we'll cover all the different things
that you could do with it.
But it essentially, it will show you
the time between the packets.
This is very help, helpful in finding
performance issues. So if you look at a,
particularly a TCP handshake and
it's going back and forth, and you're not
seeing this happening in a timely manner,
this may give you a hint that there's a problem
by looking at the delta of the packets.
You're going to see the source and
the destination where the data is
originating from and where it's going.
Some protocol information which is held
by a file in Wireshark so that it will
tell you what protocol it is, for example,
if it's DHCP, or it's SNMP, or it's SNTP,
whatever that protocol is,
it will show you, if it knows.
And then the most helpful column
is the info column, where it's going to tell you
specifically the information that will then be
translated down into the details pane.
So, the details pane of that packet
will show you everything that you see
particularly of value in the packets list pane.
But it will show you more granular detail.
So here we can see again,
once we drill down into the packet,
the details of it. We can see more information.
And you'll be able to see things such as,
codes, frame types and headers.
So, what that leaves as with is that
packet bytes, which is going to be the most
granular information.
This is the information that's translated up
into the details so that you could see
what that is and it's essentially the word data.
And it could be viewed in hexadecimal
format or bits or ASCII characters.