From the course: Wireshark Essential Training

Unlock the full course today

Join today to access over 22,600 courses taught by industry experts or purchase this course individually.

Subset, save, and export

Subset, save, and export - Wireshark Tutorial

From the course: Wireshark Essential Training

Start my 1-month free trial

Subset, save, and export

“

- [Narrator] Sometimes when working with packet captures you get a really large file, and need to break it down to a smaller subset and send it off for analysis or keep it for later discovery. Now this packet capture, down below, you see that there's 54,102 packets. Well I just want to make it a little smaller. And we'll pretend in this case that the intrusion detection system set on alert, that someone was going to a website, and they downloaded something that somehow looks suspicious. So you pull off the file and you bring it into Wireshark, and since it was HTTP let's just go through and do a filter. We do would display filter by typing HTTP. Now the next thing is, I don't want the online certificate status protocol, so, I right click and prepares a filter, and then say, and not selected. Now remember when I say prepares a filter, it simply puts it up there for me to run. To make sure it's what I want. Now I do want this, so will go up and press enter. And then again, that will…

Contents