The next module will be on profiles.
So why is the profile important?
So a profile like that quickly use Wireshark
set up specific preferences you will,
you will use ongoing - these are things
that the changes that you can make such as
things that you want to see when,
everytime you open up Wireshark,
things that you don't want to see.
Here's a good example.
Let's say you wanted to use Wireshark to
to capture data and you didn't know really
what IP addresses you were looking at
and you wanted those IP addresses to be
resolved to a local DNS server.
So you could set in your preferences,
to always resolve the DNS server name,
server names of the IP addresses captured
and you can configure that in the profile
on seeing the profile.
So that everytime you load up Wireshark,
you could select that profile
and each and everytime you capture,
it will query the local DNS server and
try to resolve those names for you.
So, why does it not come like that by default?
The good question may be that
DNS traffic, DNS create, create a lot of traffic.
You will actually see this traffic
when you're running your capture so
you may or may not want to do that.
It may send so much traffic to your
DNS server, you know, thousands of packets,
It may be an issue but those are the options.
Those are the types of things that if you
want to set them up everytime you use
Wireshark, you could select from that profile.
Here's a good example
when you may want to use it.
You want to run a quick capture.
You're not going to capture more than,
let's say, a hundred packets.
You've set up your pre-capture filter
and you wanted to resolve DNS.
You select that profile, you hit go,
and it's done for you.
When you customize Wireshark, you do,
you do so use the profiles, set preferences
and then you save it as a profile.
And you could find that in the edit menu.
You could select configuration profile,
profiles and or click on shift control A.
Once you do select the profile for use,
excuse me, you will find this on the
bottom right part of the capture window.
It'll tell what profile and you can even click
in that area and you can select
the different profile.
So, why is this important?
'Cause you can very quickly select
through what profiles you want to see,
you could set up one for wireless.
It's a, it's, it's different, it adds
a new toolbar, toolbar to your window.
There's just certain things that you may
want to configure in these profiles
so that when you're operating,
you can operate quickly.
Now, just a side note on the operating quickly.
I don't condone rushing through anything.
I think, I think that's not what I'm implying.
I think what we're implying
is that you want to be prepared
to operate the, as efficiently as you can.
Because sometimes when you're having
problems, that is, the pressure
and the stress to solve that problem
you don't want to be, you know, navigating
through Wireshark trying to configure things.
You want to have your system as
prepped and prepared as possible
so that when you're moving through
and you're trying to do stuff, you can
quickly adjust your system,
capture the data that you want
and try to analyze it in a,
and again in efficient manner.
So how you configure these profiles
quickly and easily, that's what this is about.
This is about taking the time in advance
to set your system up, set your tool up.
so that when you get into the heat of battle,
you can select what you need to see
and, and get it set as quickly as possible.
So when you're configuring a profile basically
you're going to have your default profile.
It's recommended that if you start going in
and you really start tweaking
that you save, save your default profile and
you know, you can always go back in
and re-install Wireshark very quickly.
This will allow you to refresh everything
if you make a mess of it.
Or you can go into the files themselves
and save them and then reuse them.
You can transfer files between
Wireshark users if you want to try to use
other people's profile so that something
you can do, you can load other profiles.
But here, you're going to see some
standard ones generally, the default.
I created one called "use DNS resolution".
Basically, it's just what the preference
is set to resolve the DNS name.
And when I load up, if I want to
resolve DNS, I could select this profile
and where I go when resolving DNS.
Case used, scenarios where you're
going to use these types of profiles,
I hinted on a few of them.
Some of the bigger ones are with
VOIP and wireless, particularly with
wireless because there's a lot of
specific things that you want to set
as preferences and save them to
a particular profile, so that when you
are troubleshooting with wireless,
you can just load up those preferences
rather quickly and you will be ready to go.
And here you can see in the preferences,
which we'll, we'll talk about it a little bit more
are the preferences particularly here,
the name resolution - this is what I adjusted to
configure my current, my new profile
so that it will resolve particularly the DNS names
of the IP addresses upon capture.