In our next module, we will talk about exporting data
and why exporting data is relevant
and important when working with Wireshark.
So, why would we export data?
Obviously, as we drill down into the tool,
the export option, you'll be able to see
specifically, how it does so but
there's, there's times when you want to export
key conversation, maybe send just that conversation
and the easiest way to send it in a
simple text file to share with others.
You can save that or export that in ASCII text
and send it.
There's other reasons to change.
You might have to change the format to,
let's say, postscript, scripts.
So there's, there's reasons to export the data.
And there are multiple file or export formats that you can use.
You can export it into C rays.
We already mentioned the ASCII and postscript.
CSV is also extremely helpful.
When we were talking about advanced statistics,
there are ways to take data,
drop it into a spreadsheet program,
such as Microsoft Excel and do advanced
statistical operation on it.
So, there are many reasons and
many ways to take data out of Wireshark.
Obviously, we talked about how to file,
save as different formats and
how to, how to change how the file is saved but
it's a little bit different where we're actually exporting
data directly out of Wireshark
and when we do so, we can, we can adjust
those settings pretty specifically.
So, just to give you an example,
if you were going to export
you can open Wireshark,
open up a previous capture and we can file
and then we have export, specific or specified packets,
packet dissections, packet bytes.
We can export SSL session keys, very helpful.
And we can export objects.
So, if we wanted to do dissections,
we can do as a text file.
We'd mentioned that we can export as a CSP,
and when we do that, again,
some specific things that you can select here
such as the file name, you can do all packets,
packet range and so on and so forth,
very customizable.
But just remember that
the reason why you're using this is to get data
out of Wireshark quite possibly to use it in a different format.
CSP which I have selected here is
very helpful if you want just a straight file data
in a spreadsheet that you can further manipulate in another tool,
and so on and so forth.
You can also export objects.
This is extremely helpful.
We've highlighted on this earlier
when we were talking about capturing and troubleshooting
HTTP traffic, there's DICOM and SMB, as well.
For example, if I wanted to see
specifically all the pages in a capture
for HTTP, I can do that by quickly opening up an HTTP capture
and then file export objects HTTP
and it will provide me specifically
what those objects are.
So the packet number and exactly
what objects here are mapped to what.
So, very simple one, however,
it can get very complex depending on the capture.
And you can use other tools,
for example, server message block,
if you wanted to see file shares,
or paths through the network, map drives and so on.
And you can use other export objects options.
And an example here, we just see some,
some HTTP objects.
Here's a list of some, some things that
were explored from Google, as you can see
it'll show you the objects, it's a very quick way
to see exactly what's going on,
what pages were hit, and so on and so forth.
As you can see, exporting data
there's many different ways,
many different things you can get out of it,
and there are, they're very helpful
depending on what it is that you want to do with that data.
For example, like we said, if you want some simple data
to export, to put into another tool,
and or if you want to do this advanced ones
with the object to see specific things like
map drives or file shares on your network.