In this video, we are going to learn all the functions that are added in the main toolbar or menu bar.
This is the main toolbar.
It contains the functions that you are going to use on a regular basis.
So let's get started.
A red button from the left stops capturing backwards our Wireshark session.
So let me click on it.
And the first button allows you to start capturing packets or a new Wireshark session.
Click on it.
As you can see, a white shark is asking me to see the already captured packets before starting a new
session.
So click on See Now Down Here, right?
The file name.
Click on Save.
As you can see, Wireshark has started a new session.
Right now, next function that we have is restart current, capturing it, basically terminate the current
session and start a new session.
So let me click on it.
And this time I'm going to click on Continue Without Saving.
Then we have captured options.
Capture options can't be used when you have a wireshark session running.
Right.
So let me stop it now, as you can see.
Capture options has been enabled.
Click on it.
Capture options displays you all the installed network interface card just like you would welcome a
window.
The difference is that capture options gives us a much better control over interfaces.
We have a dedicated video for Capture Options.
For now, click on Close.
Next, two buttons are open a capture file and save this capture file.
We have already covered these two buttons in the second lecture of this section.
Right then we have closed a button.
It basically closes the current file and takes you back to the welcome window.
Continue without saving, as you can see.
Next function that we have is a reload this file.
It basically reloads or refreshes your file.
Then we have find a packet, a click on it.
This function allows us to find or search the packets with different parameters.
So click on this dropdown.
We can use display filter, hex value string and a regular expression.
Right?
We haven't covered display filters and regular expression yet.
You will automatically learn to use these to when you will complete the filters section.
So let me show you how to use string and hex value.
So click on the string.
String basically means Dexter.
So in the search box, type the string that you want to search for, let me search for Letty d c ied.
As you can see down here, back at number eight does contain the text DC IED.
Right.
So what Wireshark is going to do, it will highlight or take you to the packet that contains whatever
string you write here in the search box.
So click on Find or Press Enter.
As you can see, Wireshark is highlighting the packet that contained a DCI ID.
And if you click on Find Again now it is showing the next packet that contains the DCI, right?
In the same way you can use hex values, so click on it.
Now you have to write a hex value.
Let me type, let me 70.
To be honest, I guess you are not going to use this feature that often.
Right?
So let me click on find.
Now, as you can see, Wireshark is highlighting the packet that contained the value seven D right in
the packet about section.
It is highlighting the value seven D as you can see.
Now moving on then we have left and right arrow buttons.
Left Arrow Button basically takes you one place up from its current position.
And as you can see right now, my current position is back at number 17.
So if I click on the left arrow, as you can see, it takes me one packet up and right arrow button.
Takes me one, back it down.
Then we have go to a specific packet.
So click on it in the box.
Type the package number.
Let's see, three, five.
Now click on go to packet or press enter.
As you can see now, packet number 35 is highlighted because this is what we type in the go to a specific
box.
Alright, so whatever packet you want to go to write the packet number here.
Then you can click on go to the packet.
Next two buttons are down A2 and up A2 up.
A2 takes you to the first packet in the list and down arrow takes you to the last packet in the list,
as you can see.
And then we have automatically scroll to the last packet during live captured.
When you have this button enabled, it basically highlights or you can see automatically scroll to the
last packet that Wireshark captures during a live session.
By default, this button is enabled.
As you can see, it has this light a blue background colour, right?
It means it is enabled if you click on it.
As you can see now, it has been disabled.
I'm going to enable it back now.
Next function that we have is draw back using colouring rules.
We have packets with different colours, right?
These colours help us to identify the types of traffic.
As you can see, DHCP packets have grey background colour and ICMP packets have a different colour.
Right.
So what charter does by default it assigns a unique colour to most common network traffic.
Right.
It helps us to easily identify the traffic or packets.
So if you want to know which colour is associated with which traffic, then go to the view.
Click on colouring rules.
As you can see here, we have a complete a list of colorized traffic.
UDP packets have a light and blue background color.
DHCP packets have a grey background colour and DHCP reset packets have a red background colour.
Right.
We can actually modify and add our own colouring rules in the list.
Okay.
We will learn how to colorize the traffic in a dedicated video right now.
Let's say you want to change the background colour of our traffic, so click on it.
Now down here, click on the background colour from here, select the colour, then click on.
Okay.
In the same way you can change the background colour of text or fonts, all you have to do click on
foreground.
Then from here select the colour, click on okay.
Then it will change your foreground colours as well to apply changes.
Click on okay.
If you click on the button then it will remove the packet colorization.
Right now all the packets are looking.
See?
Right.
Okay.
I'm going to enable it back because it is immensely helpful.
The next two buttons are plus and minus plus button basically increases the font size as you can see,
and minus button decreases the font size and a button next to minus set the font size to a default.
So let me click on it.
As you can see now, last function in the main toolbar is resize back it at least columns to fit the
contents can trace.
The destination column is overlapping the information of source column, right?
So when you click on this button, as you can see, the content of each column is being displayed properly.
Right now, the columns are not overlapping each other.