Wireshark packet capture basics in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Wireshark?

Wireshark is a free tool used to capture and analyze network packets. It helps you see what data is moving through a network in real time.

beginner

What is a packet in networking?

A packet is a small piece of data sent over a network. It contains information like sender, receiver, and the actual message.

beginner

How do you start capturing packets in Wireshark?

You select the network interface (like Wi-Fi or Ethernet) in Wireshark and click the start button to begin capturing packets.

beginner

What is a filter in Wireshark?

A filter helps you see only the packets you want by setting rules, like showing only web traffic or packets from a specific IP address.

beginner

Why is it important to stop capturing packets after you finish?

Stopping capture saves system resources and prevents collecting too much data, which can be hard to analyze and may include sensitive information.

What does Wireshark primarily do?

A Captures and analyzes network packets

B Blocks unwanted network traffic

C Encrypts network data

D Creates network connections

Wireshark captures and analyzes packets traveling through a network.

Which of these is needed to start capturing packets in Wireshark?

A Close all other programs

B Select a network interface

C Restart the computer

D Enter a password

You must select the network interface (like Wi-Fi) to capture packets from that network.

What is the purpose of a filter in Wireshark?

A To delete captured packets

B To speed up the internet

C To show only specific packets

D To change packet contents

Filters help you focus on certain packets by showing only those that match your criteria.

What information does a network packet usually contain?

A Only the sender's name

B User passwords only

C The entire website content

D Sender, receiver, and data

Packets include sender and receiver addresses plus the actual data being sent.

Why should you stop capturing packets when done?

A To save system resources and avoid too much data

B To delete Wireshark from the computer

C To disconnect from the internet

D To speed up the network

Stopping capture prevents overload and protects sensitive data from being collected unnecessarily.

Explain what Wireshark does and why it is useful for network analysis.

Think about how you can see what data moves through your internet connection.

Describe the steps to start and stop a packet capture in Wireshark.

Focus on the buttons and choices you make in the Wireshark interface.