Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

networking > wireshark > Flashcards

wireshark Flashcards

1
Q

how to find ip address both way source and destination

A

ip.addr= xx.xx.xx.xx
ip.src == xx.xx.xx.xx
ip.dst=xx.xx.xx.xx

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

how to find subnet

A

ip == xx.xx.xx.0/24

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what source and destination network

A

source is outgoing traffic
destination is incoming traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

how to find required port and in both ways

A

tcp.port== xx or udp.port ==xx
tcp.srcport==x or udp.srcport ==xx
tcp.dstport==x or udp.dstport==xx

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

type of Application Level Protocol Filters

A

HTTP,HTTPS,DNS,DHCP,SMTP,POP3,IMAP,SNMP,Telent,SSH,RDP,SIP,BGP,LDAP,NFS,SMB,ICMP,MQTT,Kerberos,bootp,rdp,smb or smb2,websocket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

HTTP

A

http

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Capture HTTP Requests

A

http.request.method == “XXX”
we can use POST,GET,PUT,DELETE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Capture Specific HTTP Response Codes

A

http.response.code ==XXX

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

how to find hash (sha256,sha1and etc) value of the capture file?

A

statistics->capture file proprties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

how to search for specified string in packet examples(shash)

A

edit -> find packet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

how to find files within capture packet

A

file -> export objects (option : http,smp,tftp,DICOM,imf)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

apply it as a filter in Packet List Pane

A

select packet -> double click -> apply as filiter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Statistics –> Resolved Addresses

A

hosts,ports,capture file comment information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Statistic –> Conversations

A

ethernet, IPv4, IPv6, TCP and UDP.(show conversations event within capture pcap file)
Conversations focus on interactions between them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Statistics –> Endpoints

A

Ethernet, IPv4, IPv6, TCP and UDP only endpoints device traffic
Endpoints focus on single devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

statistics ->ipv4 statistics

A

all ip addressess
destinations and ports
IP protocol type
source and destinations addressess traffic info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

statistics -> dns

A

all DNS packets from the capture file
DNS service’s overall usage, including rcode, opcode, class, query type, service and query stats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

statistics -> http

A

packet counter (count http request,response code)
requests (request by host )
load distribution ()
request sequences

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Search a value inside packets explane with question find all apache servers

A

contains
examples :http.server contains “Apache”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Search a pattern of a regular expression. and examples Find all .php and .html pages.

A

matches
http.host matches “.(php|html)”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Search a value or field inside of a specific scope and examples :Find all packets that use ports 80, 443 or 8080.

A

in
tcp.port in {80 443 8080}

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

upper and lower

A

for uppercase use upper
lowercase use lower

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Convert a non-string value to a string.
Example Find all frames with odd numbers.

A

string(frame.number) matches “[13579]$”

output:
1
3
5
7
9
11
13
15
…

24
Q

tcp connect scan in wireshark

A

tcp.flags.syn==1 and tcp.flags.ack==0 and tcp.window_size > 1024

25
Q

SYN Scans

A

tcp.flags.syn==1 and tcp.flags.ack==0 and tcp.window_size <= 1024

26
Q

udp scan

A

icmp.type==3 and icmp.code==3

27
Q

only syn flag
only ack flag

A

tcp.flags==2(only display syn flags)
tcp.flags==16(only display ack flags)

28
Q

syn flag is set. The rest of the bits are not important.
ACK flag is set. The rest of the bits are not important.

A

tcp.flags.syn == 1(display include flags like syn,ack..

tcp.flags.ack == 16
(display include flags like ack.rst,syn.ack..

29
Q

Only SYN, ACK flags.

A

tcp.flags == 18

30
Q

Only RST flag.

A

tcp.flags == 4

31
Q

RST flag is set. The rest of the bits are not important.

A

tcp.flags.reset == 1
(rst.ack

32
Q

RST and ACK are set. The rest of the bits are not important.

A

(tcp.flags.reset == 1) and (tcp.flags.ack == 1)

33
Q

arp requests

A

arp.opcode==1

34
Q

arp response

A

arp.opcode==2

35
Q

mac address

36
Q

source MAC and destination MAC address

A

eth.src
eth.dst

37
Q

Possible ARP flooding from detection:

A

((arp) && (arp.opcode == 1)) && (arp.src.hw_mac == xx:xx:xx:xx:xx:xx)

38
Q

Possible ARP poisoning detection

A

arp.duplicate-address-detected

39
Q

dhcp

A

dhcp or bootp
help assign Ip address in network

40
Q

dhcp request

A

dhcp.option.dhcp==3
contain information about hostname

41
Q

dhcp ack

A

dhcp.option.dhcp==5
accepted requested to assign Ip address

42
Q

dhcp nak

A

dhcp.option.dhcp==6
denied request to assign ip address

43
Q

to find hostname in dhcp traffic

A

dhcp.option.hostname contains “host_name “

44
Q

to find domain name in dhcp traffic

A

dhcp.option.domain_name contains “keyword”

45
Q

ftp response code

A

tp.response.code ==xxx

46
Q

Information request responses.

A

211: System status.
212: Directory status.
213: File status

47
Q

x2x series: Connection messages.

A

220: Service ready.
227: Entering passive mode.
228: Long passive mode.
229: Extended passive mode

48
Q

Authentication messages.

A

230: User login.
231: User logout.
331: Valid username.
430: Invalid username or password
530: No login, invalid password.

49
Q

to find which use

A

byb using
ftp.request.command== “user”
we can use “USER”,”PASS”,”CWD”,LIST”

50
Q

List target username.

A

(ftp.response.code == 530) and (ftp.response.arg contains “username”)

51
Q

List targets for a static password.

A

(ftp.request.command == “PASS” ) and (ftp.request.arg == “password”)

52
Q

ftp arguments

53
Q

to find user-agent

A

http.user_agent contains”chrome”
chrome,namp and etc

54
Q

how to find Hostname

A

http.host contains “name”

55
Q

Connection status.

A

http.connection == “Keep-Alive”

networking (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions