Network Traffic Monitoring

Question 1

Which of the following suspicious traffic signatures exposes malicious attempts such as
ping sweep, port scan, and DNS querying?

Answer 1

Reconnaissance

Question 2

Which of the following filters in Wireshark displays only the traffic in a LAN (192.168.x.x)
between workstations and servers with no Internet?

Answer 2

ip.src==192.168.0.0/16 and ip.dst==192.168.0.0/16

Question 3

Which of the following display filters in Wireshark is used to perform filtering by multiple
IP addresses?

Answer 3

ip.addr == 10.0.0.4 or ip.addr == 10.0.0.5