In our next module, setting filters,
as we touched on throughout the course,
setting filters is a way for you to take a gigantic data dump.
Whatever it is that your NIC card is capturing or is being sent to your machine
possibly through a mirrored port or stand port,
and finding what it is that you, finding what it is that you really want to see.
So, a good example would be, I install Wireshark
in a machine and I just run a capture.
And I want to now see specifically something that tells me
what, from what source to what destination is possibly a problem.
So here's an example. There's a client accessing an application.
They're claiming that they have an issue. It seems to be only that client.
It's a web-based application.
Well, I would then want to know what the source IP of the application is.
And I would want to know the source IP of the, or should I say, the source IP of the client
and the destination IP of the application.
And then I can build the filter specifically on that conversation and I can then
view in the, from the packets list pane and refined in the packets list pane.
Wireshark filters are used to help you to more effectively troubleshoot a problem.
Instead of looking at a ton of data,
you can really drill down into what it is that you want to see.
If you only want to see ICMP traffic,
you can write a filter for ICMP. It will only show you ICMP.
If you want to look specifically at a DNS traffic,
you can write a DNS filter. It will show you just the DNS traffic.
And so on and so forth.
And that's another reason why we needed to know our protocols
and TCP/IP protocol sweep because as you start to troubleshoot
and you know what the problem, what,
where you think the problem may be revolving around,
maybe it's a DHCP problem. You can just filter out everything except for that traffic.
It allows you to refine the view. As we've seen in some earlier modules,
we wanted to quickly look at something. So what we were able to do is
we were able to highlight that traffic.
Get rid of everything else and just see what we want to see.
And one point to mention is you can also continue to run filters on already filtered data.
So you can actually drill down deeper and deeper
as you, as you learn how to use the tool.
You know, just need to write one display filter and look for traffic.
You can really start drilling down and that's when we get into
writing some more deeper or more granular filters to find specific data.
So applying a filter is actually very simple.
There's many ways to do it.
What we looked at before, before we started the module
we answered the question about packet loss and how we might find that.
We wound up going to the statistics menu.
In the statistics menu, we wanted to see the conversations.
Right from there, we could right click and apply a filter.
We could filter pretty much anywhere in this tool.
You can right click right off the packet and generate a filter.
You can use the toolbar to make a filter. You can use the contacts menu.
You can make filters within your I/O graph.
You can pretty much apply filters everywhere you go
and the reason for that is because the more helpful,
the more granular you can get what it is that you're trying to solve and troubleshoot,
the more helpful it will be after you apply the filter.
So as we discussed before, there are 2 main filter types -
there's a capture filter and there's a display filter.
Th capture filter use the Berkeley format and
it is a little bit more limited. It's different than a display filter.
It will not allow you to do everything that a display filter can do.
And in some instances, the syntax is different.
So learning filters, it will require you to look at
both separately, as well as together because
in some aspects, they're similar, obviously, the concept of filtering is the same
and you want to remove things that you don't want to see and granulize the view.
However, the way that you do it will be slightly different.
And also remember that a capture filter is applied before you start the capture.
Where as the display filter is applied after you've run the capture.
And you want to then filter out data that you don't want to see.
Th capture filter will eliminate it completely from the capture, you will never see it.
So configuring a capture filter, we'll do this live here.
So if I wanted to capture some data,
I can go into select an interface, go into capture options.
I can apply a capture filter right here.
So, in this instance, I want to say, alright I don't any ARP traffic at all in my capture.
So I am going to filter all ARP traffic before.
It will not put it in the capture once I am done running a capture.
So we're going to see no ARP and we're going to start the capture.
And I will try to generate some traffic here.
As we can see, no ARP. So that's a pre-capture filter.
So what's a display filter? What's the difference here?
Ok, well, here I may want to say, ok, IP only and it will only show me the IP traffic.
There's many things that you can typewrite in once you start to learn.
Otherwise you can build your filter. You can specifically take from many
different types and build them, boolean and apply them.
So in this case, we may want to filter out HTTP.
You can search for it, and then drill down and find specific things that you want.
And clear it once you're done. Alright, so next stop,
some simple Wireshark expressions.
Basically, if you wanted to capture traffic to or from a specific IP address,
you could put host in and you could put the IP address of it in.
This will capture data just for that host. You can also add the net mask.
And you can capture based on a specific port.
You can go deeper. However, these are some of the more common things
that you will do as you're learning Wireshark.
It's recommended that you apply and test some of these specific filters.
So you can get a taste of what it can do and then expand from there.
The best way to do it is to practise so the more you work with it
you'll see that if something's allowed, it will be in the display filter.
It'll be green. If you're making a mistake as you're typing it out, it will be red.
So it's very helpful. It's dropped down.
It sent contact sensitive so that as you're typing things in it will try to help you out.
And it is something that as you learn your protocols
and what it is that you can and can't do,
you will be able to be more flexible within writing your filters.
And as you can see here, one of, a more advanced filter.
Specifically I'm looking for a hardware address as a destination.
So as you learn more and more about it, you will be able to populate specifically
what it is that you do or don't want to see.
You can remove various, specific things or entire protocols all together.
So why do we use filters? Well, for one reason,
you try to stream on your view board traffic
because as you're working through your traffic analysis you may
see things from a whole hosts of IP's.
And you're just trying to figure out something from one source to a destination.
We'll get more into it in a future module but that conversations tool allows you to really see
what's talking in your capture file and it's very helpful to go right there
to, you know, right click from there and apply filters because
you can then, instead of sifting through the capture itself, you could see specifically
what your top talkers are. Who's having the most conversations?
And lastly, it will help you to remove anything that you don't want to see.
So you're not confused as to having this gigantic data dump of information.
It removes any extrenuous data that is really not relevant.
It can, you know, busy up the capture.
And lastly, it'll just give you, the analyst, a clearer view as to, of what's there,
so you that you can get to the root cause of the problem through isolation.