In this lecture, we are going to learn how to see our export specific packets.
When you see packets into a file by default, Wireshark saves all the captured packets.
Right.
But we can also see specific packets as well.
Right?
We can save only filtered packets or the packets that you select manually.
Right.
Wireshark allows us to save specific packets from both unsaved and already saved file.
It is actually pretty simple.
So.
Let me grab some packets first.
Now, as you can see, Wireshark has captured a plenty of packets.
Right.
Now, I don't want to save all the captured packets.
Right.
Instead, I only want to save, let's say, the DNS packets.
So apply the filter in your display filter bar.
The ANS hit enter.
Now I want to save only the DNS or filtered packets.
So to do that, go to the file, click on export specific packets.
Now down here, as you can see, by default, all packets button is selected right inside this captured
file there are total 813 packets and displayed packets means the filtered packets.
There are total 82 filtered or DNS packets.
Right.
So let it be all packets.
Now give your file in name DNS.
Now click on Save.
Now let me open the DNS file.
As you can see, guys inside the DNS file, we only have the DNS packets, right?
So guys, in this way you can basically apply a filter, then save the filtered packets.
Now let me open another file.
Okay.
Now, as you can see, this is an already saved file.
Right now, I'm going to carve out or save specific packets from this existing file.
Right.
In this file, I have a plenty of traffic.
Right.
So I am only going to save ICMP packets from this file.
So let me apply the filter.
Now, again, repeat the process.
Go to the file, click on export.
Now let's see ICMP click on Save.
Now let me open the saved file, which is ICMP.
As you can see inside this file, I only have the ICMP packets.
Now, let's select the packets manually.
Now select the package that you want to save.
Press and hold the control button, then select the packets.
I'm going to select this three way handshake.
First three packets and another packet will be the fourth packet, which is an ICMP packet.
Now go to the file, click on export specific packets.
Now here, as you can see, we have the option selected packets only click on the button.
It also tells you how many packets you have selected.
As you can see, I have selected four packets.
So give your file a name selected.
Click on Save.
Now let me open the selected file.
As you can see, there is inside this file.
I only have the packets that I selected and exported.
Right.
Again, go to the file, click on export specific packets.
Now select the range option.
Here you can specify a range, right.
So I'm going to specify from 1 to 3.
So Wireshark is going to save packets from 1 to 3, right?
It will see the three way handshake.
Now give a name to your file range.
Click on Save.
Now, we should have first three packets go to the file range.
As you can see, guys, we have first three packets.