Wireshark packet capture basics in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to start capturing packets on the default network interface in Wireshark.

Cybersecurity

wireshark -i [1]

Drag options to blanks, or click blank then click option'

Anone

Beth0

Call

Ddefault

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'default', which is not a valid interface name.

Using 'all', which is not a valid interface name in this context.

The -i eth0 option tells Wireshark to capture packets on the eth0 network interface, which is commonly used as the default.

2fill in blank

medium

Complete the command to capture only TCP packets using a capture filter in Wireshark.

Cybersecurity

wireshark -f "[1]"

Drag options to blanks, or click blank then click option'

Atcp

Budp

Cicmp

Darp

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'udp' which captures UDP packets instead of TCP.

Using 'icmp' which captures ping packets.

The capture filter tcp limits the capture to TCP packets only.

3fill in blank

hard

Fix the error in the command to save captured packets to a file named capture.pcap.

Cybersecurity

wireshark -w [1]

Drag options to blanks, or click blank then click option'

Acapture.log

Bcapture.txt

Ccapture.csv

Dcapture.pcap

Attempts:

3 left

💡 Hint

Common Mistakes

Using .txt or .csv extensions which are not valid for packet capture files.

Using .log which is a generic log file format.

The -w option saves the capture to a file, which should have the .pcap extension for packet capture files.

4fill in blank

hard

Fill both blanks to create a display filter that shows only HTTP traffic from source IP 192.168.1.10.

Cybersecurity

http && ip.src == [1] && [2]

Drag options to blanks, or click blank then click option'

A192.168.1.10

Btcp.port == 80

Cudp.port == 53

Dip.dst == 192.168.1.10

Attempts:

3 left

💡 Hint

Common Mistakes

Using destination IP instead of source IP.

Using UDP port 53 which is for DNS, not HTTP.

The filter ip.src == 192.168.1.10 selects packets from that source IP, and tcp.port == 80 filters HTTP traffic which uses TCP port 80.

5fill in blank

hard

Fill all three blanks to create a capture filter that captures only ICMP packets from network 10.0.0.0/24 excluding broadcast address.

Cybersecurity

icmp and src net [1] and not dst host [2] and not dst host [3]

Drag options to blanks, or click blank then click option'

A10.0.0.0/24

B10.0.0.255

C255.255.255.255

D10.0.0.1

Attempts:

3 left

💡 Hint

Common Mistakes

Not excluding broadcast addresses causing extra packets to be captured.

Using wrong subnet mask or IP addresses.

The filter captures ICMP packets from the 10.0.0.0/24 network, excluding the broadcast addresses 10.0.0.255 and 255.255.255.255.