Network forensics

Question 1

what is wireshark

Answer 1

wireshark is a GUI that is used to determine network packets

Question 2

What is wireshark used for solving?

Answer 2

troubleshooting network issues
Network security issues
Debugging protocols

Question 3

What is a capture filter

Answer 3

Capture filter is a filter that captures traffic that specifically matches that capture filter rule

Question 4

What are the benefits of a capture filter

Answer 4

prevents packet loss
saves disk space

Question 5

What is a display filter?

Answer 5

to tweak appearance

Question 6

What does this filter mean “ ip.addr == 10.0.0.1

Answer 6

Sources/ destination

Question 7

What does this filter mean 10.0.0.1 and 10.0.0.2

Answer 7

Communication between packets

Question 8

what does this filter mean http or dns

Answer 8

displays filter for all http or dns

Question 9

what does this filter mean tcp.port.4000

Answer 9

find the specific tcp port 4000

Question 10

what does this filter mean tcp.flags.reset

Answer 10

reset all tcp flags

Question 11

what does this filter mean http.request

Answer 11

display all http requests

Question 12

what does this filter mean tcp contains reviews

Answer 12

find all tcp packets that contain the word review

Question 13

what does this filter mean ! (arp, icmp and dns)

Answer 13

don’t find either of these three protocols