Wireshark is an overwhelming tool, right?
So in this video, we are going to understand its overwhelming interface.
What all these different components and sections mean.
So go to the we will give you a menu.
Lets you decide the components that you want to appear in your display area.
As you can see, White Shark has pre-selected some of the components for us.
First three selected components are main toolbar, filter, toolbar and status bar.
This is the main toolbar.
It contains the functions that you are going to use or access on a regular basis.
Then we have Filter Toolbar.
This is the filter bar.
Filter bar allows us to right the filter.
Filters are used for filtering or removing the unnecessary traffic.
For now, you don't have to worry about filters because we have a dedicated section for filters.
Just remember that if you want to filter the traffic, then you can write and apply your filters here
in the filter.
But then we have a status bar at the bottom.
This is the status bar.
It gives you a summary of captured and lost packets on your bottom.
Right click on profile profile menu.
Displays all the profiles, including the default profiles and the profiles that you have created.
We will get back to profiles in a separate video.
Now from your bottom left.
You can access properties of the file that you have opened in the white shark.
So click on the button, open the captured file properties.
So at the top, we have a destination where a file has been saved.
Then file size, hash values extension used for saving the file.
And down here, we have all other relevant details about the file.
Now we can copy properties of the file.
All you have to do is click on the button at the bottom.
Copied to clipboard.
Now you can paste the copied details into each file.
Now click on Close.
Next component that we have is Bucket List.
This section or panel is called Bucket List.
Bucket List displays the captured packets.
Every packet that Wireshark captures is displayed or listed here in the packet list section.
Right.
Then we have packet details.
This section in the middle is packet details.
Right.
Packet details, as the name suggests.
It displays a detailed information about the selected packet packet list.
Section only gives you a brief summary of each packet in the list.
So if you want to analyse packets in detail, all you have to do is click on the packet that you want
to analyse.
Okay, I'm going to click on packet number food now down here.
Packet details section is displaying all the available information for the selected packet in detail.
In other words, packet details basically displays all the encapsulated protocols in the selected packet.
Right.
So to analyse any packet in detail, click on the packet that you want to analyse.
Then in the packet details section, you can analyze the selected packet in detail.
As you can see, as I am clicking on different packets, information keeps changing in the packet detailed
section.
Then we have packet bytes.
This is the packet byte section at the bottom.
Packet bytes displays contents of the selected packet in its a raw form of binary or hexadecimal.
Hexadecimal is the default format.
So let me select, let's say packet number five.
Now packet bytes is displaying.
All the information or content which is inside the selected packet in hexadecimal.
Like I said earlier, it displays content in its original form.
So if a packet contains an encrypted or data in plaintext, then it displays the unencrypted data as
it is.
Let's take an example.
As you can see in the packet, a number five, we have a domain name, beacon dot LGBT two dot com.
Right, which is an encrypted.
And on the right side of packet about section, we can see the domain name beacon dot dot com.
Right.
So an encrypted data is always displayed on the right side in the packet about a section.
Information is not organized right.
It is hard to find or read a specific information.
So if you want to check a specific information or value in hexadecimal, then it is actually easy.
So let me expand the user datagram protocol header and I'm going to click on the source board field.
Now packet byte section is highlighting the selected information, which in my case is source board
53.
It is two bytes number.
So if you convert this highlighted hexadecimal number 0035 into decimal, then you will get a 53.
Okay.
Now let me click on a length again.
If you convert the highlighted hexadecimal number into decimal, then you are going to get 70.
So whatever field you click on the packet, a detailed section packet about will automatically highlight
the selected field or value in the field in hexadecimal or a binary.
Now let's change the hexadecimal to binary.
So right click on the blank space.
Click on as base as you can see.
Now we have information in binary, right?
I am going to revert back to the default hexadecimal format because it is a little more readable then
the binary.
Right.
So right click again show bytes as hexadecimal.