- [Instructor] Once you get used
to the basic features of Wireshark,
it's time to learn some more advanced features to
make your life easier when using Wireshark.
One of these useful
extra Wireshark features includes using filters.
Wireshark sometimes gives you the experience
of information overload because there's so much to review.
Therefore, knowing how to use filters is essential to
avoid this information overload problem.
In our previous lesson,
we already used a filter to hide network messages
other than those using transmission control protocol or TCP.
Another useful feature is DNS resolution.
Usually you get a bunch
of numeric IP addresses in your Wireshark display.
Resolving these IP addresses
into more meaningful domain names allows you to spot hosts
of your interest more quickly.
Another useful feature is to start your Wireshark program
and to be able to catch your packets right away
without really having to navigate
through the graphical user interface or GUI
and then start capturing packets.
You can also use Wireshark to create rules
to be used by your file software.
Lastly, Wireshark can capture packets
from a remote computer.
Let's say that you want to use your Wireshark program
on a local computer to snip packets going
through the network interface of a remote windows host
in your network.
To make this happen,
the first requirement is to install WinPcap
on the remote windows host.
WinPcap is an underlying tool
that allows packet snippers
like Wireshark to capture packets directly
from network interfaces.
Assuming that WinPcap is active
and running as a background process
on a remote windows host, let's proceed
with configuring Wireshark to receive the remote packets.
Click on capture, options,
manage interfaces and then remote interfaces.
Click on the plus sign,
enter the host IP and the port number.
And that's all you have to do.
Now, you're ready to receive packets
from a remote network interface.
In the next lesson, we'll continue to explore
the advanced Wireshark features such as DNS resolution,
capturing packets by bypassing GUI,
and how to create firewall rules using Wireshark.
Are you ready?