NEW
Font size
WorksheetsExploring Network Forensics with Wireshark
Total questions: 10
Worksheet time: 5mins
What is the purpose of packet analysis in network forensics?
To configure network devices and enhance connectivity.
To optimize network performance and reduce latency.
To monitor bandwidth usage and manage traffic flow.
To identify anomalies, detect security breaches, and gather evidence for investigations.
Describe a technique used for analyzing packet data in Wireshark.
Using Display Filters to isolate specific packet data.
Utilizing Capture Filters to limit packet capture.
Using Color Coding to highlight packet types.
Applying Protocol Hierarchy to summarize data.
How can you apply display filters in Wireshark?
Select the filter from the preferences menu.
Click on the packet to view details.
Use the right-click menu to apply filters.
Enter the filter expression in the display filter bar and press Enter.
What is the difference between capture filters and display filters?
Capture filters only work on TCP packets; display filters work on all packet types.
Capture filters display packets in real-time; display filters save packets for later analysis.
Capture filters filter packets during capture; display filters filter packets after capture.
Capture filters analyze packets after capture; display filters analyze packets during capture.
Explain how to identify unusual traffic patterns in a network capture.
Unusual traffic patterns can be identified by analyzing traffic volume, source/destination IPs, port usage, protocols, packet sizes, and statistical outliers.
Monitor only the total number of packets exchanged.
Examine the timestamps of packet arrivals exclusively.
Focus solely on the geographic location of IP addresses.
What Wireshark filter would you use to find HTTP traffic?
http
tcp
udp
ftp
What are some common indicators of a network anomaly?
Fewer login attempts
Consistent traffic patterns
Common indicators of a network anomaly include unusual traffic patterns, spikes in bandwidth usage, increased latency, unknown devices, and repeated failed login attempts.
Decreased bandwidth usage
How can you use Wireshark to detect a DDoS attack?
Ignore packet types and focus solely on bandwidth usage.
Use Wireshark to monitor traffic for spikes, identify source IPs, and analyze packet types.
Analyze only the destination IPs to find the attack source.
Use Wireshark to block all incoming traffic and prevent any analysis.
What is the significance of the TCP three-way handshake in packet analysis?
The TCP three-way handshake is a technique for routing packets efficiently.
The TCP three-way handshake is a method for compressing packet sizes.
The TCP three-way handshake is used to encrypt data during transmission.
The TCP three-way handshake is significant in packet analysis as it ensures reliable connection establishment and synchronization of sequence numbers between communicating devices.
How can you export packet data from Wireshark for further analysis?
Use 'File' > 'Export Specified Packets' to export packet data.
Use 'Tools' > 'Import Data' to analyze packets.
Click on 'View' > 'Save As' to export packets.
Select 'Edit' > 'Copy' to save packet data.
