4.6 Extract Files from a TCP Stream When Given a PCAP File and Wireshark 200-201 Practice Questions (Page 7)

Questions 31–34

1. 31expert · hard

   An analyst is analyzing a PCAP and needs to extract a file from a TCP stream that uses a protocol with a dynamic port. The analyst has identified the stream but the data appears to be compressed. What is the best approach to extract the file?

   • AUse Export Objects > HTTP to save the file.
   • BUse the display filter 'tcp.port==80' to find the stream.
   • CChange the stream direction to 'Server to Client' and save as raw.
   • DFollow the TCP stream, save the raw data, and then decompress the data using the appropriate decompression tool.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   When you select a packet in the Packet List pane, which pane shows the decoded protocol fields of that packet?

   • APacket Bytes pane
   • BPacket List pane
   • CFilter toolbar
   • DPacket Details pane
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   When saving a followed TCP stream in Wireshark, what is the purpose of choosing the 'Raw' format?

   • AIt converts the stream data to a human-readable text format
   • BIt compresses the data to reduce file size
   • CIt saves the stream data exactly as it appeared on the wire, without any formatting
   • DIt adds timestamps and packet headers to the data
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What does Wireshark's 'Follow TCP Stream' feature do?

   • AIt captures new packets from the network interface
   • BIt exports all packets in the capture to a text file
   • CIt reassembles and displays the application data exchanged in a TCP connection
   • DIt decodes the TCP headers of a single packet
   Reveal Solution Discussion Select an answer first