- [Instructor] Let's try some more advanced
Wireshark features.
The first one I'd like to show you
is how to start Wireshark packet capturing
directly without going
through the initial gooey screen.
Type sudo space Wireshark space -i space.
Here, I stands for interface.
Let's make a choice in terms
of which interface to monitor.
The interface number starts with one.
I have only one interface on this host.
Therefore, the interface number is one.
Type one space, next type - k
which is the option
that starts the capture session immediately.
Now, press enter.
As you can see,
we're completely bypassing the initial gooey screen.
Let's generate some more traffic
by opening up our web browser.
Let's visit world wide web.Microsoft.com
Type www.microsoft.com press enter.
You can see a lot more traffic being generated.
There's so many IP address numbers
and it will be nice if you could turn some
of them into more meaningful domain names.
How do we do that?
Let's go to view and select name resolution
and choose resolve network addresses.
As soon as I do that,
some of the IP addresses are now turned into domain names.
Lastly, let's try the tools menu option
and then choose firewall ACL or access control list rules.
Using this tool
you can generate a firewall rule automatically.
Note that before using this tool,
you need to pick and choose a particular entry
in the Wireshark window.
Let's close this window
and stop snipping.
Pick and choose one of the entries.
Then choose the tools menu option again
and click on firewall, ACL rules.
Next select the file product you're using.
We'll keep the default option, which is not filter.
You also have options to specify more details
like denying inbound traffic as part of the firewall rule.
You can now copy the rules
and add them to your net filter shell script.
There are many more advanced features to explore.
I recommend that you keep trying to discover them
as you get more familiar with Wireshark.