Wireshark packet capture basics in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

📋 Factual

intermediate

What is the primary function of Wireshark?

Wireshark is a popular tool used in cybersecurity. What is its main purpose?

A To capture and analyze network packets in real time

B To encrypt network traffic for secure communication

C To block unauthorized network access

D To scan computers for viruses and malware

💡 Hint

Think about what Wireshark does with data moving through a network.

Wireshark captures network packets and allows users to inspect their contents to understand network behavior and troubleshoot issues.

🧠 Conceptual

intermediate

Which filter would you use to see only HTTP traffic in Wireshark?

You want to view only web traffic using Wireshark. Which display filter should you apply?

A tcp.port == 80

B udp.port == 53

C icmp

D tcp.port == 443

💡 Hint

HTTP usually uses a specific TCP port number.

HTTP traffic typically uses TCP port 80, so filtering by tcp.port == 80 shows only HTTP packets.

🔍 Analysis

advanced

What does the 'No. of packets' column represent in Wireshark capture summary?

In Wireshark's capture summary, what does the 'No. of packets' column indicate?

A The number of packets sent by the selected device only

B The total number of packets captured in the entire session

C The number of packets in the current filtered view

D The number of packets dropped during capture

💡 Hint

Consider what the summary shows before applying any filters.

The 'No. of packets' column shows the total packets captured during the session, regardless of filters.

❓ Reasoning

advanced

Why might some packets be missing in a Wireshark capture?

During a capture, you notice some expected packets are missing. What is a likely reason?

A Wireshark automatically deletes packets after 10 seconds

B The network cable was unplugged during capture

C The packets were encrypted and cannot be captured

D The capture interface was not set to promiscuous mode

💡 Hint

Think about how network interfaces receive packets not addressed to them.

If the interface is not in promiscuous mode, it only captures packets addressed to it, missing others on the network.

❓ Comparison

expert

Which statement correctly compares capture filters and display filters in Wireshark?

Choose the option that accurately describes the difference between capture filters and display filters in Wireshark.

A Capture filters are applied after capture; display filters are applied during capture

B Display filters limit which packets are saved during capture; capture filters only hide packets after capture

C Capture filters limit which packets are saved during capture; display filters only hide packets after capture

D Both capture and display filters work the same way and can be used interchangeably

💡 Hint

Consider when each filter type is applied in the capture process.

Capture filters decide which packets are recorded during capture, reducing file size. Display filters only change what is shown after capture without removing packets.