Ok, welcome back.
In our last few modules, we will talk about
about importing and exporting and merging options within Wireshark.
And this is basically to get data inside or out of
Wireshark, predominantly for use for analysis and importing .
Obviously, if you wanted to import data,
it's not the same as opening a capture. It's a limited option.
But specifically, when you're importing
you're using Wireshark to import hex.
You can adjust this a little bit and I will show this to you.
But essentially, the hex dump that you get from another system,
you can reconstruct into packets in Wireshark which we will demonstrate.
So why is this useful?
There are times where you may capture hex data, let's say, from another tool,
or you're doing some analysis work and you get a, a dump of hex.
And that data may be completely unreadable to you and what would be easier than to
quickly import it into Wireshark to establish a viewable conversation.
So that's what we're going to do - we're going to create a packet,
based communication viewable in the packet in the capture window when we import the data.
So what I've created here is a simple hex data dump.
There's many ways to do this. You can pull this out of a stream.
There's tools that will give you hex dumps but
as an example, if you're given a hex dump
which may be completely unreadable to you.
All you need to do is you need to import that data
by going to file import from hex dump
and then browse to that particular file that we created.
And import, and you have options you can change your encapsulation type and
this specific offsets octo or decimal or other things that you can change.
But for simple import, if we do so, we will import and there you go.
There's your hex dump now created into a full conversation
so that you can see what exactly it is that you have in here.
And you can comment it, imported from hex dump file x, y and z.
Any other data you find relevant and you will be able to now save this as a Wireshark capture
for future reference. Very helpful, extremely helpful.
Again if you are getting data that you don't know what you are looking at,
try to reconstruct it in something that would make more sense to you.
So you can set some options, you can change the format,
the encapsulation and the offsets, as well as other settings.
And you can recreate the conversation in the capture window for further analysis.
And as you can see, once we complete the rebuild, we can then dive into the data
to review some specifics about it such as
date, the time, any flags, source and destination information and so on and so forth.
Again, extremely critical, you get a hex dump, you don't even know what you're looking at.
You're not going to sit there and translate the entire thing.
Much quicker, more efficient to import into Wireshark and
very quickly recreate conversation.