Welcome back.
We will be discussing the merging of data,
the use of multiple files and so on and so forth
with Wireshark and why this is important
when you're running captures and trying to analyze data.
One of the things to highlight is that why we would merge files?
So, if I had collected data from a source and I collected data from a destination,
to merge these files specifically, I would need to know
some pretty important things about them.
For example, I have different options.
I could prepend it so that when I merge the files, one file will go before the other file.
And it won't be merged chronologically.
Or I can append it, it would be after.
Or I can merge them chronologically together.
So there's 3 main options and reasons to do this.
So, if you want to just side by side views of data,
then you would obviously pick pre or append options.
But if you wanted to merge them together in a way where you can look at the files in one
chronological list, then you would merge them chronologically.
So very important, when you're looking at files and I'll give you an example of that in Wireshark.
So, in our example here,
obviously I want to first see what files it is that I'm thinking of merging.
And I can go to file and file set.
I specifically am using a capture where I have a large amount of
files that basically are all in order of capture.
And I can switch between them to review them if I need to.
But if I wanted to merge them, I could append them each to one file with the merge option.
So there's reasons here why you want to do this.
Obviously, the 2 main reasons would be
that you had ran capture and split up some data.
And then you want to put it all back in one capture and analyze it in one chunk.
Or you would want take 2 different captures and
maybe merge so that you could take a look
specifically at what it is that you were looking to add together.
So to merge very simply, file merge.
Select the files and combine them together. It's a very simple operation,
and once you're done, you will be able to either append,
prepend, or chronologically merge the data together.
You can also use the command line to do this.
Mergecap will allow you to merge files at the command line.
Again, you would want to type man mergecap so that you could see
what options or switches available to you to
to perform an append or a prepend, as an example.
So just remember that you can also do these options directly at the command line.
And then once you do merge the data, you can select specifically,
as you can see in the options here.
Do I want to prepend the packets to an existing file?
Do I want to merge the packets chronologically?
Or do I want to append the packets to an existing file?
Again, there's reasons for doing each.
If you've recorded a list, again when we were talking about the
the slicing up of a pre-capture option setting and I want to have a few files
and now I want to combine them. This might be an option to do so
and or if I'm troubleshooting a network and I need to look at everything in one capture,
I may want to append, prepend or merge chronologically.
Just want to take a moment to thank everybody for their participation in
INE's Wireshark Foundations.
It was a chance for us at INE to give you the student exactly what you would need
to work with Wireshark out of the box to get it up and running
and to get moving with it.
So our goal was to give you a set of classes
that allowed you to move from basic knowledge
to a more advanced level and to get the hang of using Wireshark
more from a field perspective, get the look and feel down,
know the tools available within it, different options, things you can do,
troubleshoot with different types of protocols
and what you can use within Wireshark to help you dissect that traffic
to be able to look within it to see exactly where, where a problem may be.
Again with Wireshark, it's just a tool.
It can't take away from you, it's only an extension of you -
and the more you know about networking,
the more you know about protocols and traffic, and analysis and networking,
the better off you will be once you learn how to use Wireshark.
So again, I appreciate your participation. I thank you greatly for your time
and I look forward to working with you all in the future.