4.6 Extract Files from a TCP Stream When Given a PCAP File and Wireshark 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · medium

   An analyst is investigating a PCAP that contains a file download. The analyst has identified the TCP stream that carried the download by looking at the 'TCP Stream' column. However, the stream number is not visible in the packet list. What should the analyst do to display the stream number?

   • ARight-click a column header in the packet list and select 'Column Preferences' to add the 'TCP Stream' column.
   • BUse the 'Edit' > 'Find Packet' feature to search for the stream number.
   • CUse the 'Statistics' > 'Conversations' menu to view the stream number.
   • DApply a display filter for 'tcp.stream' to see the stream number in the packet details.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst has extracted a file from a TCP stream in a PCAP. The file is supposed to be a Windows executable. Before submitting the file to a sandbox for analysis, the analyst wants to ensure the extraction was successful and the file is not corrupted. Which step should the analyst take?

   • AOpen the file in a text editor to see if it contains readable strings.
   • BRename the file with a .exe extension and run it on a test machine.
   • CCheck the file's magic bytes to confirm it starts with 'MZ' and compare its SHA-256 hash to the hash from the original PCAP if available.
   • DUse the 'file' command to identify the file type and check its size against the expected size from the HTTP response headers.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   If a TCP stream contains an image file, which display format in the Follow TCP Stream window would best help you recognize that it is binary?

   • AASCII
   • BHex Dump
   • CEBCDIC
   • DYAML
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   After extracting a file from a TCP stream in Wireshark, an analyst wants to confirm that the extracted file is identical to the original file transferred. Which step is most appropriate?

   • AOpen the file in a text editor and visually compare the content with the stream data.
   • BCheck the file size in Wireshark's packet details pane.
   • CRe-follow the stream and save it again with a different filename.
   • DCompare the MD5 or SHA-256 hash of the extracted file with the hash provided in the original transfer metadata or a known-good source.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   After following a TCP stream in Wireshark, how can you save the raw data of that stream to a file?

   • AUse the 'Export Packet Bytes' option in the File menu
   • BCopy the stream from the window and paste it into a text editor
   • CRight-click the stream and select 'Save Stream'
   • DClick 'Save as' in the Follow TCP Stream window and choose the 'Raw' format
   Reveal Solution Discussion Select an answer first