4.6 Extract Files from a TCP Stream When Given a PCAP File and Wireshark 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following best describes the role of a PCAP file in network intrusion analysis?

   • AIt contains the configuration settings for a network switch
   • BIt provides a historical record of network traffic that can be examined for signs of malicious activity
   • CIt stores the output of an intrusion detection system's alerts
   • DIt contains a list of IP addresses that are blocked by the firewall
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst is examining a PCAP that contains a suspicious file transfer over a non-standard port. The analyst follows the TCP stream and sees binary data. The analyst suspects the stream contains an image file. Which approach should the analyst use to extract the image from the stream?

   • ASave the entire raw stream to a file and then use a file carving tool to locate the JPEG signature and extract the image.
   • BSearch the raw stream data for the JPEG file signature (FF D8 FF) and save the bytes from that signature to the end of the stream.
   • CUse Wireshark's 'Export Objects' feature to extract the image directly from the stream.
   • DIdentify the JPEG file signature (FF D8 FF) in the raw stream, note the offset, and save the bytes from that offset to the end of the image (identified by the FF D9 marker).
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In Wireshark, which pane displays a summary of each packet, including source and destination addresses and protocol information?

   • APacket Details pane
   • BPacket List pane
   • CCapture Options dialog
   • DPacket Bytes pane
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An analyst is investigating a PCAP of an HTTP session where a user downloaded a file from a server. The analyst needs to save the exact bytes of the file as they appeared on the wire. What is the most direct way to accomplish this in Wireshark?

   • ARight-click a packet in the TCP stream, select Follow > TCP Stream, then choose 'Show data as: Raw' and click Save as.
   • BApply a display filter for 'tcp.stream eq 0' and then use File > Export Packet Dissections > As Plain Text.
   • CUse the Export Objects > HTTP menu and select the file from the list.
   • DCopy the hex dump from the bytes pane and paste it into a hex editor.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An analyst is extracting a file from a TCP stream that was transferred using a protocol that adds a 4-byte length prefix before each chunk. The analyst has followed the stream and saved the raw data. The extracted file fails to open. What is the most likely cause and the correct next step?

   • AThe saved raw data includes the length prefixes; the analyst should remove the 4-byte prefixes from the raw data before saving the file.
   • BThe file was transferred in the opposite direction; the analyst should re-follow the stream in the other direction.
   • CThe file is corrupted in the capture; the analyst should re-capture the traffic.
   • DThe file is encrypted; the analyst should decrypt the stream before saving.
   Reveal Solution Discussion Select an answer first