Ok, welcome back. We're going to talk our last module on
the saving of files and saving them correctly
is to briefly discuss the different formats on which you can save them.
So file formats, obviously as we narrow down the,
the options to save our files, you can save them in different formats.
And why would you do this?
So there are many other tools out there.
There's TCP dump, there's WIN dump.
There's wireless packet capture tools,
there's fluke analyzers, there's window server network monitor.
There's literally dozens of available tools out there
and a lot of them if not all of them, save them in different file formats.
So being able to transfer and open these files
in between all these systems requires you to
really take a look at a, you know, what you're saving it as
and how you can take your data and then make it open in those other tools and vice versa.
So, just remember that you need to consider opening in different formats,
so saving in different formats so when you are working with others in
the world of network analysis or protocol analysis
just be aware to ask the question - what tool are you using particularly
and what format do yo expect to get this in?
Also, as we mentioned earlier, you can save in the old Pcap format or the Pcap-ng,
the next generation format which will allow you to
do more or save more from capture file.
Good in, good to know that a lot of them will open up with the Pcap.
So, some of these tools will open your file,
regardless, but in any case, generally I like to stick to one rule.
I like to record or capture with a tool.
And save it in that native format and try to use it and analyze it within that native format.
And not bounce the file around too much in between tools because
you tend to lose some information.
And just remember that it's essential
because a lot of what you're trying to do is look at all the data that you can.
Again, yes, we're going to refine it but we don't want to lose
key information within that file before we refine it that we may need.
So just be aware of that. Also most compress with some type of file compressor,
Gzip, there's many, Winzip, there's multiple compression utilities,
just make sure that when you decompress the file or extract it,
you download and use the correct tool,
and extract the files and check and validate them.
As we mentioned earlier, in the earlier module,
you can file save as and save the file with an intelligent name.
And save it in a place where you can reference it. You can make it secure.
Also select the correct or appropriate file format that you want to save this file in
so that you can open in the correct tool or you do not lose,
you retain all the information that it is that you captured with the native tool.
So as we mentioned, there's many tools.
TCP dump is one of the most common.
It's generally interchangeable. You have Windows version.
You have network monitor. You have, like I had mentioned before,
fluke has a series of tools. As we looked in the save as dialog
there's a pretty much a flavor of packet capture for many of the different versions of Unix,
for example, Sun Solaris or AIX or so on and so forth, HPUX.
Just remember when you file save as,
you save it as a format in which you can open it and analyze
the data within it and hopefully not lose any of the captured information.