Welcome back. In our next module, we will talk about capture filters.
When you use Wireshark, you're able to capture a whole lot of data and
the key to really analyzing that data is to streamline
or filter what it is that you will see once you're done capturing.
So as we talked about in earlier module is you want to, you want to make sure
that you have Wireshark placed correctly. It's in the right spot.
You're capturing specific data from the source to destination.
And then once you're done, you can filter on that data
to granulize what it is that you captured so that you could troubleshoot it.
But there'll be times where you will want to take that data and minimize what you see
prior to stopping the capture and here's an example.
Let's say, you are only interested in seeing data
on your network and you're not really worried about
analyzing anything from your machine.
You can actually restrict or tell Wireshark to restrict
the data from your machine so that it doesn't get caught up in your capture.
And you don't have to filter it out afterwards.
So what's nice about that is you're already in a position where
you don't have to get inundated with data and
you know, you can limit what it is that you see.
So with Wireshark filters, first of all, what's a filter?
A filter is what's going to allow you to, to break down what it is you are seeing
and, and refine it so that you're looking for specific
IP addresses, protocols, specific ports,
things that you're looking for to aid in your troubleshootings.
So for an example,
if you're looking to troubleshoot a client access to an application
you may only want to see the IP address activity
from the source of the client to the destination server,
and you're not really worried about, for example, the other ARP broadcast.
So you're not worried about net bios broadcast.
So you're not worried about SNMP traffic.
You're not worried about anything, any of that.
And you're able to filter all that stuff out.
And again, what's nice is that with Wireshark you have 2 different types of filters.
You can the capture or I like to call them pre-capture filter,
because you're, before running your capture again you're restricting
what it is that you don't want to see.
And then after, afterwards,
you can also continue to drill down with the display filter but
again you minimize what it is that you see from when you first run the capture.
So, what does it help you do?
Well, it aids in your ability to troubleshoot.
Again, as we just mentioned, if you're looking for a specific source to a destination
and you're trying to analyze that, you don't really need to see all of that traffic.
So let's just drill down into that specific conversation
and we can remove all the rest.
You do this to refine the view and it allows you to go into the packets list pane
and really say, alright, if I'm looking for, you know, IP address 10.1.2.1
and a destination of 192.168.10.3
you're only going to see the communication from those 2 systems
and it will highlight in the packets list pane
and remove that communication and remove all the rest.
So as we mentioned before, you have 2 types of filters that you can apply.
Again, as we mentioned, one's the capture filter.
And plainly explained, this is used to filter data before it is captured by Wireshark.
So again, you're saying if you set up a capture filter,
let's say, no ARP,
when you run your capture, no ARP traffic will be collected.
And then again, the display is when you want to capture everything
and then refine down or you can also capture
data with a, with a pre-capture or capture filter and then a
then once you're stopped at a capture, you can apply display filter to it.
So you could also use them in tandem.
So you configure a capture filter, basically what you want to do is you want to
load Wireshark and once you have Wireshark up,
you can go to capture options, and from here you can select an interface.
So for this example, I am going to use the, my wireless interface.
And then here, you could say, I want to set up a capture filter.
Now, we're going to do this one very simply.
We're going to select IP only and hit ok and then start.
Now, essentially, all these, Wireshark's going to do right now,
only capture IP traffic.
Now again, what's good about that is if you're trying to, you know, again
as we said, just look for some specific traffic
and you can actually specify the IP address as well.
If you're just looking for some specific traffic,
then this, this will in fact allow you to
block out everything else except for that traffic.
Now, as we said before, you could select any of your interfaces.
You can then save your capture filter. You can type it directly into the, the area there.
You can say specifically host the broadcast host and IP address.
One thing to remember is this uses the Berkeley format.
And it's not the same as a display filter.
It's, it's less flexible. It's more like TCP dump.
So you're not going to be able to just do anything with a pre-capture filter.
It's meant to really just isolate or remove bulk traffic as I like to call it.
You know, taking ARP out, taking net bios out, taking UDP out, taking your IP address out.
So you don't see any unicast to your machine.
So again, this is specific to pre, to pre-capture, applying a capture filter.
And it will only allow you to do so much so don't,
you know, don't think that it's just going to
you know, allow you to do everything that a display filter will.
And again, just to remind you, you can still, once you stop the capture
as you could see, I only have IP traffic here.
I can still apply a display filter directly to the data that's been captured with the capture filter
so they do work in tandem.
So, just to summarize, again your filtering that you do with
Wireshark is specific to streamlining your view.
Making what it is that you want to troubleshoot very granular
and making sure that, you know,
you're zooming in on what it is that you want to see.
It's removing stuff that you don't want to see and from there, it will give you, the analyst
the clear view of being able to troubleshoot this and find root cause
data of what the problem could be.
Thanks again for the questions that you're posting to the forum.
One very good question was - Are the default files, folder structure files enabled
for Wireshark, and if so, which one is based on the, the capture filters?
So, if you're studying for the exam, the Wireshark certified network analyst exam,
one of the key questions that they'll ask which you'll, you'll find as you navigate Wireshark
is specific files that you need to know about and how the file structures layout in Wireshark.
So, one of the things you can do is to go to help.
And in here, in the help menu, you can go to about Wireshark.
Now, if you go to the folders tab, you will see direct links to
specifically where data is kept for Wireshark.
So, one of the things that you can do is you can go the system folder.
And once you open the system folder, you will see in here specific files.
And the answer to that question is the, the C filter file.
So that's the default name for the, for the capture filter file.