Wireshark
Fast practice, instant feedback. Timer auto-submits when time’s up.
Avg score: 5% Most missed: “Show all DHCP traffic”
Wireshark
Time left 00:00
25 Questions

1. Packet Info pane, Internet Protocol V4 data | Make sure Menu, Edit, Name Resolution > options are checked | Resolve hostnames for SSL protected traffic

2. Show all packets coming from the POP server

3. Packet Info pane: drop down Bootstrap Protocol" | Filter on the UDP port used by clients for DHCP Discovery and Requests"

4. filter: tcp.port == 80 and eth.addr == e8:b1:fc:5c:8d:ca

5. What type of pack is being displayed with with the following filter: 'apr.opcode ==1' ? What type of information does it provide?

6. Identify that data is SSL/TLS protected

7. Show all packets associated with all SIP VoIP sessions

8. Show all packets to or from specified IP.

9. Filter on a specific IP address but not including another IP address.

10. Can find clear text passwords and logins, as well as other interesting information | Identify HTTP POST. What is its significance?

11. Show all packets associated with all H.323 VoIP sessions

12. filter: tcp.flags == 0x002(syn), 0x012(syn,ack), 0x010 (ack)

13. filter: ftp

14. filter: eth.addr == 00:00:5e:00:53:00 and http

15. Wireshark Filter Format

16. Filter to show all TCP packets

17. filter: wlan.fc.type_subtype == 0x02 | or in | Probe Request Frame | filter: wlan.fc.type_subtype == 0x04 | Identify the supported data rates of a wireless Client.

18. Filter to show packets that contain a Telnet authentication string

19. Show all packets associated with all RTP VoIP sessions

20. Demonstrate the ability to decrypt IEEE 802.11 WEP protected frames using the following WEP key: DDC96DF8D0

21. filter: sip

22. Menu, Capture, Options.

23. Show all packets that start an email message.

24. What's happening in a Probe Request Frame?

25. Click 'Statistics', select 'Protocol Hierarchy'