Wireshark Summative (Project 4, Bootcon)

What is the primary function of Wireshark?

• To encrypt network communication
• To capture and analyze network traffic
• To prevent network attacks
• To monitor network performance

How do you start a packet capture in Wireshark?

• Click "Statistics" > "Start Capture"
• Click "File" > "Open"
• Click "Edit" > "Preferences"
• Click "Capture" > "Start"

What is a common indicator of a port scan in Wireshark?

• Slow packet responses
• High UDP packet counts
• Repeated SYN packets from one source to multiple destinations
• Unusual DNS traffic

What is the purpose of protocol analysis for HTTP traffic in Wireshark?

• To block unwanted traffic
• To examine and identify signs of eavesdropping or manipulation
• To capture SSL traffic
• To encrypt HTTP packets

How can you detect suspicious DNS activity in Wireshark?

• By focusing on SYN packets
• By analyzing unexpected or fraudulent DNS responses
• By looking at large file transfers
• By filtering for HTTP traffic

What does the "Display Filter" in Wireshark do?

• To view only HTTP traffic
• To summarize packet data
• To isolate specific packets during a capture
• To prevent packets from being captured

What does the "Statistics" menu in Wireshark help you analyze?

• Raw packet bytes
• Network traffic patterns, protocols, and endpoints
• Only DNS traffic
• Packet header details

How do you filter for HTTP traffic in Wireshark?

• Use the filter `tcp.port == 53`
• Use the filter `ip.addr == 192.168.1.1`
• Use the filter `dns`
• Use the filter `http`

What is a common sign of eavesdropping or network manipulation in HTTP traffic?

• High volume of SYN packets
• Excessive HTTP requests to one server
• Unexpected data in HTTP packets, such as altered content
• Slow DNS resolution times

How can you detect DNS anomalies or spoofing in Wireshark?

• By focusing on SYN packets
• By monitoring only ICMP traffic
• By identifying multiple DNS responses from different sources for the same query
• By looking at UDP traffic only