In our next segment, we will talk about marking and annotating and working with file data
so that you can make notes in your packet captures
for future reference or use and how to navigate those notes
or those annotations within the, within the capture file.
So, why is this so important?
Some may think that annotating files is probably
not the most important topic in the world.
However, I believe that documentation is key
to pretty much everything that it is that we do.
One example would be, you're asked to build and design a network
and I'd like you to do that in your head and not use a Visio diagram.
You probably could fabricate it in your mind but then when you need to translate
that to someone else for them to work on your network,
not only it would be tedious for you to explain everything but
a picture says a thousand words. And there's a reference for it,
specifically for when things change and
you add to the network or upgrade or change or flip by piece subnets
or whatever you're doing, having documentation is critical.
And I think we can all as network analysts, engineers and experts at least agree that
network documentation is key to our success and survival.
And the purpose of file and packet annotation
is so that you can document what it is that you're doing.
So obviously, if you saved the file, you want to save it with an appropriate name.
But more so, what if you wanted to save some information in the capture itself
and allow for it to be something that you can use or of relevance while you're troubleshooting.
So, 2 very important types of annotation is
the file itself as well as packet annotation.
Now annotating files is something that is newer
to Wireshark and one of the key things here is
to remember that you must save the file as a Pcap-ng for it to retain this information.
If you save it in an older file format such as Pcap, it will not retain this information.
So that is the, the rule to using this.
And to do it is actually quite simple.
So we'll first start off with a packet annotation.
And here as I was looking at a capture I just did,
I had a file here that is interesting to me so I can right click it and
select packet comment and I can put what I thought was interesting in here
which I could say encrypted data using TLS,
inspect further and, you know, that's just a simple note but
one of the things I wanted to show you here was how in the details frame,
a packet comments field popped up and interestingly I can see
that it allowed me to actually add to the data in the capture
so that I can reference it at another time.
So I can make this pretty extensive. I can write some details like perhaps
you know, maybe going to incorrect gateway or
invalid router hop or something of that nature where
when I now go into other tools, I can reference that even further.
So as an example, I can go into analyze, click the Expert info
and as we've mentioned in the past, if I go to packet comments tab now,
there is my packet comment.
And it tells me at packet 11 and it shows me the summary of my comment -
encrypted data using TLS, inspect further.
Now again, this is a very simple way to show you this
but you can make this information as extensive as you need to and
more relevant to a possible problem that you may be experiencing.
So, as we dig deeper into the annotations,
you can see here, I added specifically, one where I said, you know,
there's a segment here that I'd like to check out
and put the date and the time of reference and there's a whole bunch of stuff
that we could put in here to help ourselves create documentation.
And what's interesting is you can also do a summary
so when you pull up Wireshark and you want a summary of the entire file,
you will also find some of these annotations in there as well.
So, we did this live, but basically to explain how to make and save an annotation,
you select a file, or I should say, packet that you want to annotate.
You right click it, you add a comment,
you make your relevant notes, you close the comment and then just make sure that you save
the file in the correct file format which is Pcap-ng.
You can also reference this file anytime in the capture window.
As we mentioned, you can go to the Expert and
flag specifically what packet number that was,
and you can look at it in the packets list and the details pane as well.
There are many ways to make an annotation.
And the one I will show you now is making an annotation on the file.
So in the bottom left corner here, there's a little notepad and a pencil
that if you can click on it, you can edit or add capture comments.
So I can say something simply like, capture file number X or number 1,
date, time, testing, connection from client to server through 4 router hops,
using subnet 10.1.1.x/24 and so on and so forth.
So as you can see, there's quite a few things that once you put them in here and save,
you'll be able to show, you know, whatever notes you wanted to take.
And as I showed you here, I went to the summary,
the capture summary and here are my comments.
I can copy, cut and paste. I can save all this information right into that capture file or
place it outside in a report but regardless,
this is why annotations are critically important.