In this lecture, we are going to cover two interesting topics.
One, how to automatically split packets into multiple files during Wireshark capture session.
And two, how to automatically stop capturing packets based on different parameters.
Right?
So let's start with splitting packets into multiple files.
Wireshark Files can easily get very large, right when you start capturing packets.
Your capture file size can easily go in hundreds of megabytes or even in gigabytes.
Right?
Once your capture size goes beyond 500 megabytes, then Wireshark starts slowing down.
Large files create problems.
When you open a large file of, let's say, 500 megabytes or one gigabytes, then your Wireshark will
not work properly.
It will slow down, and you might experience frequent crashes as well.
So to manage large files effectively, Wireshark allows us to save captured packets into multiple files
automatically during the capture session.
We can restrict how many packets we want to save in a single file.
Wireshark does it automatically.
Now let's do it practically.
So go to the capture, click on options and now click on output tab here.
Click on the button.
Create a new file automatically.
Options below it have been enabled.
Right now we can create a new file automatically based on these available parameters.
Right.
We will go through each option.
So let's start with the first option.
So click on the button.
Now this option creates a new file automatically.
When Wireshark saves the specified amount of packets in a file, the default number is 100,000.
So let me put, let's say 500 in this box.
Now, Wireshark is going to save 500 packets in every file.
After saving 500 packets in a file, then Wireshark will automatically create a new file and save next
500 packets there.
So, guys, whatever number you put in here, Wireshark is going to save that many packets in a file.
Then it will switch to the next file.
Right now, we have to specify the destination where the files will be saved.
So go to the Browse.
Now, give a base name to your file.
Let's say base.
Now, Wireshark is going to save files in the following format.
First file will be saved with something like this.
Base one, then second file base two, third base three, then base four.
So on.
Right now click on Save and you can choose the output format.
A default is Pcap and G.
You can also go for Pcap as well.
I'm going to let it be Pcap and G.
Then you can choose whether you want to compress the files or not.
If you want to compress, then click on GZIP right again.
I'm going to go with the default set up now before starting the capture session.
Make sure that you have selected the interface right now.
Click on Start.
As you can see, Gates shark is automatically creating and switching files.
Okay, now let me stop the session and check whether new files have been created or not.
As you can see, these files have been created.
Right now, let's check the amount of packets saved in every file.
So let me open the first file and click on the down arrow.
As you can see, guys, inside this file, I have exactly 500 packets.
Let me check another file.
Second file.
And inside this file also, we should have 500 packets.
Right.
So, guys, Wireshark added exactly what we told it to do.
Save 500 packets in every file.
As you can see down here, each file is going to have 500 packets.
Right?
Now I'm going to demonstrate the second option.
So let me select the first option and click on the second option.
Now, this option creates a new file automatically when your file exceeds the specified size.
Right.
So let me put in here, let's say 200.
Now, Wireshark is going to create a new file automatically when your file size becomes 200 kilobytes,
and it will keep repeating it as long as Wireshark is capturing the packets.
Right now, the default selected option is kilobytes.
We can also go for megabytes and gigabytes as well.
Click on a dropdown.
Right.
As you can see, we have megabytes and gigabytes as well.
I'm going to switch back to the default kilobytes.
Again, we have to specify the destination where you want to save the files.
Here again, you have to give a base name to your file base.
Click on Save.
Make sure that you have selected the interface.
Now let me click on Start Button.
And as you can see, files are being automatically generated.
Right now, let me stop the session and check the files.
So go to the file, click on Open.
As you can see, Wireshark has created six files file size of first file is 195 kilobytes.
Size of second file is 196 kilobytes.
So size of each file is close to 200 kilobytes.
The actual size on the disk is 200 kilobytes.
Again, whatever size you put in here, Wireshark is going to create a new file after saving the specified
amount of kilobytes in the file.
Now, guys, you can try next two options by yourself.
They are very simple.
So third option is basically going to create a new file after capturing packets for the specified time.
Let me put in, let's see, ten here.
Now, Wireshark is going to capture packets for 10 seconds.
Then after that it will create a new file.
So Wireshark creates a new file in every 10 seconds, now that we have learned how to evenly distribute
packets into multiple files.
Now let's move to the auto stop means how to automatically stop capturing packets, right?
So click on options.
Now here as you can see, stop capture automatically after based on these different parameters.
So let me select the first option and let me put in here, let's say 1000.
Now Wireshark is automatically going to stop capturing packets after it captures 10,000 packets or whatever
number you put in here.
Right.
So I'm going to go back to output and deselect this option for now, create a new file automatically.
Now let me click on Start.
As you can see, guys, after capturing 1000 packets.
Wireshark Automatically stop.
Right?
So this is exactly what I told Wireshark to do, right?
Stop automatically after capturing thousand packets.
Now let's move to the next option.
I'm going to select the first one and select the second option files.
Wireshark is automatically going to stop capturing packets after creating specified amount of files.
Default number is one.
Now, let me put here, let's say five.
Now, to make this option work, we have to coordinate with this feature, create a new file automatically.
So we have to enable it.
Now, here we have to choose one of these options.
So I'm going to go with the first option.
I'm going to put 200 packets in every file.
Right now, what Wireshark is going to do.
Wireshark will create a new file automatically after saving or capturing 200 packets.
Right.
And when it creates five files or whatever a number you specify here, then Wireshark is going to automatically
stop capturing the packets.
Right now, again, we have to specify the location for saving the files base.
Click on Save.
Now let me start capturing packets.
As you can see, Wireshark has automatically stopped.
Now, let's actually check the output options.
Output.
As you can see, guys, Wireshark created exactly five files.
After that, it automatically stop.
All right, so this is exactly what we instructed Wireshark to do here.
Stop the Wireshark automatically after creating five files, and each file should have 200 packets.
Then we have a last option.
If you click on it now, put in a number, let's say 100.
Now, Wireshark is automatically going to stop capturing packets when it runs for 100 seconds.
After that, it will automatically stop capturing packets.
Of course, you can go with the minutes or hours as well.