There's a new version of Wireshark out—a new major version that has many interesting features. Here, you can see the new Qt GUI:

It looks very similar to the Legacy GTK GUI, with few minor tweaks. The main menu bar here has had some icons changed and removed; the general interface is a little bit cleaner. All the general functionality, though, is all the same. Capture options are on the upper left-hand side and they are denoted by a gear icon. When you click on the gear icon, you have multiple tabs for Input options, Output options, and general Options:

When you click on Edit | Preferences..., you can see the preferences window, as shown in the following screenshot. Options such as Show up to makes it easy to navigate and view what you need to see:

As shown in the following screenshot,...

One of the first things I'm sure you want to do in Wireshark is to begin capturing some traffic so that you can get used to the utility and possibly diagnose some issues on your own network. In this section, we'll talk about exactly that: where to capture that traffic and how to capture it.

Wireshark needs to receive packets in one way or another, so that you may begin analyzing the data and performing your network diagnostics. There are several ways of doing so in Wireshark. One way is to begin capturing on a local device with Wireshark installed through the GUI. You also have the option of doing so through a command-line. You can capture remotely from a Wireshark install on a management computer, for example. It can retrieve the packets being received and sent from a device somewhere else on your network, using a special driver install. You can also...

In this section, we'll take a look at the following subtopics:

• How to save packet captures
• How to save selected sections of packets, individual packets, and ranges of packets
• How to export packets into other formats
• How to export raw packet data from the capture that you selected

Now that we have Wireshark up and running, let's capture some traffic. We'll select the Local Area Connection, and we could either double-click as I mentioned or we'll start the capture up at the top. And we will have some packets coming in. So now, if I want to save this capture (the entire capture—all the packets that I just captured) I'll go to File | Save As...; and from here, I can simply choose a filename. So, we'll call it packets. And you'll see in the Save as type, I chose the file as pcapng:

So, pcapng is the next...

In this section, we'll take a look at the following subtopics:

• How to use the new annotation feature, also known as comments
• How to find packets that have annotations, and there are multiple ways of doing so
• How to print packets

Now, let's get some packets to work with. I'm going to start a quick capture.

To create comments for a packet capture, the entire capture itself, you can do so in the bottom left-hand corner of Wireshark. You see there are two icons down there: one's a circle icon called the expert information we'll get into in a future section, and there's a pencil with a packet capture icon. If you do a mouseover on a pencil icon, it'll say Open the Capture File Properties dialog:

Click on that and it will open up a pop-up window that gives you a bunch of different information for the capture itself...

In this section, we'll take a look at the prerequisites for using remote capture, specifically with WinPcap, which is a Windows port of the libpcap library and the configuration of remote packet capture on the remote device.

The first prerequisite is to install the pcap libraries. I'm using a Windows computer here as our test machine, so I'll install the WinPcap libraries, which are a Windows port of the libpcap libraries originally written for Linux. So what I'll do is go to https://www.winpcap.org/ and download the WinPcap libraries. Once it finishes downloading, I'll go ahead and just click on Next with the installer, and there's no need to customize...

In this section, we'll take a look at how to use that remote packet capture software that we set up with WinPcap on the remote system.

In order to use that remote WinPcap service running on the remote system and capture packets from it, we need to add that into our local Wireshark interface so that we can capture it. So in order to do this, we will perform the following steps:

1. We will go ahead and click on Capture options icon.
2. Click on Manage Interfaces... and you'll see here that there's the Remote Interfaces tab; click on that.
3. Click on the plus icon in the bottom left-hand side here.
4. Enter in the Host IP address of that remote system.
5. Click on the Password authentication radio button, and enter in the credentials for that service account that we created. I used pcap here. You can then enter in the username and password and click on OK....