Ok, in this module, we will be talking about
pre-capture settings.
So, some of the things that we want to do
when we capture data is we want to
and we had talked about this briefly earlier,
but we want to consolidate what it is that
we're seeing 'cause when we run a capture,
it's basically just everything it sees
promiscuously bring in and let's put it in
the capture window and let's take a look.
So, we're going to get into some, a deep dive
on the actual information that you'll see
with the display filters which is
after you've captured those data.
How do I refine it? How do I look in and
pull out exactly what I need?
But there's some pre-capture settings
that are, are equally important
so that when you're troubleshooting,
there's certain things that you can eliminate.
So what is that?
So, there may be times
we need to run a capture
on a production server and distribute
the information to a troubleshooting team.
I've seen this in the past where
working with an outsourced vendor,
there were something where,
you know, we needed to find an application
performance issue and they basically said,
'Well, we're going to run on a capture
for the next 2 hours and you know,
they didn't have someone
actively working with us.
They were just essentially,
you know, we'll run the capture,
you know, you try to recreate your problem
within that and then, you know, we'll get
we'll get, you know, we'll get the capture file
to you after we sanitize it and you can use it.'
Well, what we've asked for in the past is
to do some pre-capture settings
so that when we got that file,
it wasn't completely inundated with, you know,
50,000 packets of information
that we didn't need.
So what we ask for as we mentioned earlier,
we don't need to see some specific information.
Remove that completely. Do as a favor.
Can you chop it up into, you know, like
30 files at a certain size and then,
you know, zip it up and we'll have, whatever...
And that helps enormously because you're not
always going to be able to control the capture.
You're not always going to be able to control
who runs the capture.
You're not always going to be able to, you know,
control things that are outside of your,
your span of control.
So that's, that's the time or relevant time where
using these particular settings would be very,
very, very crucial to working with capturing data
especially when you're working with another team.
another team, a vendor, you know, sombody
other than, you know, working with your,
your direct team or you, yourself.
You may find that you need to set up
pre-capture settings so you eliminate
the traffic that you don't want to see.
You can limit the size of the file or files.
You can create multiple files and that also
increases the security because you don't
necessarily want to be transferring around
data that has information in it that is not only
not relevant to what it is that you're trying to do
but potentially proprietary and or,
you know, open to attack if captured.
So some of the things we can do in a
pre-capture filter is we can create a filter,
basically say, remove this information or
this information only when you run a capture.
So, yes, you can add more to this.
This is the default pre-capture filters.
But what's important here is to just take
a quick look at what you have here.
So, for example, IP only. That will only
capture IP information, no ARP.
I don't want to see any ARPing just
you know, capture everything except for ARP.
UDP only. I know that I am looking for,
let's say, DNS queries.
No zone transfers, just specific queries and
I want to capture that, I know it's only UDP.
Just run that. Those are the types of reasons
that we would use this but this is
where you would get the example.
So in the capture filter,
for ethernet address and there's some
some ethernet address that
doesn't really map to anything on your network,
that's ok because you can now
create and add your own.
You can select on new, enter the filter name
and the filter string which would be
you know, ethernet address, and then
the actual address that you're looking for.
So again, there would be some
specific detective work that you need to do.
Like you would need to know what that,
that ethernet address was.
You would need to dig that out and
add that to the filter but again, specifically,
you can use this to build
your own pre-capture filters.
So, what's the differences between a
capture and a display filter?
Actually, there's many.
So, capture filters cannot do everything
that a display filter can do.
Capture filters actually are more limited.
It's actually very similar to TCP dump.
There's certain things that you can do.
Display filters are way more granular.
There's way more things
that you can do with it.
And you would, the most obvious
difference is that you use the,
the capture filter on, before you run
your capture and then you use
your display filter to refine the data
that you've already captured.
So obviously, other than those, that glaring
very obvious difference, the other
difference is that they are not the same.
They are different and actually if you look
in the internals of Wireshark,
it actually interfaces with the
core tool differently as well.
And again, the capture filter is very, very
TCP dumpish so if you're familiar with
TCP dump, then this will be
very similar for you.