Ok, in our next module,
we will talk about multiple files.
Now, saving data, we covered in the earlier module is
the way that you can select with file format, you want to save your capture as.
However, there may be times where you need to
create very large capture files and that does not mean
necessarily mean that the file itself needs to be a one large capture file.
It just means that you need to collect
or record or capture a large amount of data
and one of the easiest way to do that is to
create a capture where it's going and dropping that information into multiple slower files
so that you can, let's say, run a capture for 2 hours.
And you only want to have an x amount of data or x amount of files or
stop after a certain amount of files or data.
And the way that you can do that is by slicing up your capture files.
So we talked about this on day 1 and in our earlier modules when we were setting up
Wireshark and when we learned about the launchpad or the start page
for when we first opened Wireshark, we learned that we can
essentially slice up our information in pre-capture files.
So, let's open up Wireshark new and let's take a look at capture options.
So in here, what I can do is I can select the interface in which I want to capture on.
And then I have, again the ability to set up the capture filter if I like.
And or set up the, where I want to put the capture file.
But there's some options under here that allows me to do exactly that.
Slice up the capture into multiple files, so one of the things that I can do,
is find where I want to place that. Well, I will put it in captures, multiple files.
And as you can see here, I've already ran a capture and diced up one into multiple files.
So I create a new folder, of course, run a test
and from here, I can then change or select options so that I can
either stop recording after or stop capturing after a certain amount of time.
I can use a ring buffer which I will explain momentarily, or I can say, ever
create a new file after a certain size of a file or certain amount of minutes.
So if I want to run a capture, for example, where I want to cut it up into some files
and I want each file to be one gig,
I can then just select that and say, and then stop after one file.
And then it's going to capture a 1gig file and then it's going to stop.
Or I can say, I want you to create a file
every 10 minutes and I want you to stop after 5 files
so it's going to give me 50 minutes of information.
So as you can see here, there's a way that you can start your capture
and customize it in a way before it kicks off to have a specific action
and dump those files directly into the directory which I just created.
So that being said, one of the most important things here
is the ring buffer which can be confusing to some.
So if you want to constantly override data,
and you only want a couple of files at all times,
you can set up the ring buffer and it will continuously record.
However, it will record the data that was already captured.
So just remember, circular or ring continuously recording over.
That's a good way to remember that.
But that being said, you slice up of your capture files,
you do this before you run a capture.
You can do so through the launchpad. You go through capture options.
You can select multiple files.
You need to select the destination and you need to select the file name.
It will append afterwards so you will see multiple files.
And then you can go ahead and slice up the files on that, those criteria options
that you selected prior to kicking off your capture.
And again, we just showed it live but specifically, here are those options.
Again you can select to do it after a certain amount of time.
You can select it to do it after a certain amount of files at a certain size.
And you can stop capture or continuously record over data in a certain amount of files.
And then your final output will be multiple files.
As you can see here, I wanted them all to be a certain size so it chunked them up.
It specifically gave me the time and date when it did so.
And I also saved the master capture there as well.
So as you can see, I am able to now distribute these files,
if they were very large. I can then send them to somebody to further help me analyze them.
And I don't have to send them a 1gigabyte file, or one large, very large file.