Pre-Quiz (Wireshark)

What does the term "Packet Capture" refer to in Wireshark?

• A method for blocking suspicious traffic
• A data encryption technique
• The process of capturing and analyzing network packets
• A single frame transmitted over a network

What is the purpose of the "Coloring Rules" feature in Wireshark?

• To block specific network traffic from being captured
• To assign colors to different packets for easier identification during capture analysis
• To highlight packets based on a specified protocol
• To encrypt captured packets for privacy

How do you capture packets from a specific network interface in Wireshark?

• Wireshark automatically selects the best interface
• Select "Capture" > "Options" and choose the desired network interface
• Manually type the network interface in the filter bar
• Filter by protocol to capture specific traffic

What does the "Statistics" menu in Wireshark provide?

• A list of errors found in the capture
• A list of all packets captured during a session
• Various analyses like protocol hierarchy, packet length distribution, and endpoint statistics
• A way to configure Wireshark’s settings

In Wireshark, what is the "Time" column used for?

• To record the time the packet was received by the system
• To display the time at which the capture was started
• To show the time spent on each packet’s transmission
• To show the time elapsed since the first packet was captured for each individual packet

What does the "TCP Handshake" process in Wireshark consist of?

• A sequence of packets used to start a TCP session between two devices (SYN, SYN-ACK, ACK)
• The process of retransmitting lost packets
• A series of packets that establish a secure VPN connection
• The process of closing a TCP connection

How would you filter HTTP traffic in Wireshark?

• `http`
• `ip.addr == 192.168.1.1`
• `tcp.port == 443`
• `dns`

What is the "Follow UDP Stream" option used for in Wireshark?

• To view the flow of all UDP packets between two endpoints
• To examine UDP packets for issues in routing
• To isolate DNS traffic
• To analyze encrypted UDP packets

What does a "TCP Retransmission" in Wireshark indicate?

• A retransmission of a TCP packet that was not successfully received by the destination
• A successful acknowledgment of packet receipt
• A data transfer completion signal
• The start of a TCP session

What is the "Packet Bytes" pane in Wireshark used for?

• To display the decoded protocol of the packet
• To show the hexadecimal and ASCII representation of the packet's raw data
• To visualize the packet transmission time
• To display the IP address of the source and destination