In this lecture, we are going to work with Wireshark Files.
We will learn to save packets, discuss different file extensions that Wireshark uses to save the packets,
converting one file extension into another reading packets from a file.
And the most important part how to use the in-built GZIP compression to compress the Wireshark files.
So let's get started.
I'm going to capture some packets first, then I will be able to save them.
Now click on the red button to stop capturing packets.
Now to save packets, go to the file, click on Save As or you can directly click on the Save button
on the main toolbar.
Save this capture file.
Now select your directory where you want to save the packets down here.
Write the file name.
Let's say dummy and you don't need to write any file extension after the file name.
Wireshark automatically saves files with Pcap and G extension PCAP and G is the default file extension
that Wireshark uses to save the packets.
So let me click on Save.
As you can see, this file has been saved with Pcap and G extension.
Wireshark supports many other formats to save the packets, so go to the file this time.
Click on Save As and click on this down arrow.
These are all the extensions that Wireshark supports to save the packets, right?
We have Pcap and g.
PCAP.
It even supports dot txt extension.
You can save your packets into a text file as well.
You are never going to use most of these extensions.
Right.
But there is one extension that you need to know about which is Pcap.
Earlier, Pcap used to be the default file extension to save the packets.
Now Pcap has been replaced by Pcap and G as the default file extension.
Pcap is a legacy extension and Pcap and G is the improved version of Pcap.
Now, the reason why you need to know about Pcap is because there are many external tools that do not
support the new Pcap and extension.
Yet Wireshark files are used by many external tools as well, such as the famous open source intrusion
detection system.
Snot tools like snot do not support the newest extension Pcap and G.
They still support the old Pcap.
You can save your files with dot pcap extension when you have to work with external tools like snort
now to save packets with dot pcap from this dropdown select pcap and write the file name.
Now click on save.
As you can see, file has been saved with p gap extension.
Now how to read packets from a file, go to the file, click on open or you can directly click on main
toolbar, open a CAPTCHA file, then double click on the file that you want to open.
Now as you can see, file has been opened.
Now we are going to learn how to convert one file extension into another.
For example, I want to convert this dummy dot pcap and g into pcap.
Now first thing that you need to do is open the file that you want to convert.
So go to the file, click on open, double click on the file that you want to convert.
So I'm going to convert this dummy dot pcap and g file.
As you can see, this is a pcap and G file, so double click on it.
Now click on file, click on Save as click on down arrow, select the Pcap extension.
Now write the file name.
Now what watch is going to do?
It will take packets from dummy dot, pcap and g file, then save those packets into this new file packet.
So if I click on save now as you can see, we have file packet dot pcap.
Now guys we are going to learn how to use the in-built GZIP compression to compress the file.
Wireshark files can easily get very large.
Right?
So when you are working with a large file then Wireshark might not work as efficiently as it does with
smaller or medium size files.
You might experience frequent crashes and it will be a bit slower as well.
Now to make your file smaller, we can use the in-built GZIP compression that Wireshark offers.
It basically helps to reduce your file size.
So let me capture some packets first.
Now, guys, I'm going to save these captured packets into two different files in first file.
I will not use the in-built compression, and in a second file I'm going to use the in-built GZIP compression.
Then we will compare the size of both the files.
So click on file save.
Now write the file name without GZIP.
Now click on Save Again.
Go to the file.
Click on Save As.
This time I'm going to click on the button down here, compress with GZIP.
So check the button.
Now write the file name, compressed file, click on Save.
As you can see at the top, the file has been compressed with dot GZIP compression.
Now let's check the size of uncompressed file first.
So the size of uncompressed file is 800 kilobytes.
Right?
Now let's check the size of compressed file.
And the size of compressed file is 648 kilobytes.
So, guys, we have saved more than 150 kilobytes of space.
The in-built GZIP is very efficient.
So when you are working with large files then use the GZIP compression it is recommended.
Now your question might be how do you uncompressed or open the compressed file?
You can open the compressed file as you would open any Wireshark file.
Just click on the compressed file.
As you can see, the compressed file has been opened without any problems.