An analyst is investigating a slow network issue and has a large capture. They need to identify whether the slowdown is due to a specific host generating excessive traffic or due to a particular protocol. The analyst wants to quickly compare the traffic volume of different IP addresses and also see the protocol distribution. Which combination of Wireshark statistics tools should be used?

Endpoints and Protocol Hierarchy

Protocol Hierarchy and IO Graph

Conversations and Follow Stream

An analyst is analyzing a large capture and wants to quickly spot all packets that contain a specific string in the payload, such as a malware signature. The analyst also wants to highlight these packets in a distinct color for easy visual identification. What is the most efficient approach?

Use a display filter with 'frame contains "signature"' and create a coloring rule for that filter.

Use the Find Packet feature to search for the string and then export the matching packets.

Use a capture filter with 'tcp contains "signature"' and then manually mark each packet.

Use Statistics > Protocol Hierarchy to locate the string and then apply a coloring rule.

An analyst has a capture that contains multiple HTTP sessions. The analyst needs to provide a colleague with a capture file that contains only the packets from a specific HTTP session, but the colleague also needs the raw HTTP objects from that session. What is the most efficient way to prepare both deliverables?

Use File > Export Objects > HTTP first, then use File > Save As to save the entire capture.

Use Statistics > Conversations and export the selected conversation as a new capture.

Use Follow TCP Stream and copy the raw data to a text file for both deliverables.

Use File > Export Specified Packets with a display filter for the TCP stream, then use File > Export Objects > HTTP on the original capture.

When you use 'Follow UDP Stream' in Wireshark, what does the stream view show?

The raw bytes of a single UDP packet

A list of all UDP ports used in the capture

The reassembled payload of all UDP packets between the two endpoints

The TCP sequence numbers and acknowledgments

An analyst has a large capture file and needs to provide only the packets related to a specific user's web browsing session to a colleague. The session involves multiple TCP connections over several minutes. The analyst wants to share a small, focused file. What is the best way to create this file?

Use File > Export Packet Dissections to save the packet details as text.

Use File > Merge to combine the capture with another file.

Use File > Save As to save the entire capture with a new name.

Apply a display filter for the user's IP and use File > Export Specified Packets to save the filtered packets.

GIAC Certified Intrusion Analyst

Domain 2Objective 4

Wireshark Fundamentals GCIA Practice Questions (Page 5)

Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 21–25

21expert · hard
An analyst is investigating a slow network issue and has a large capture. They need to identify whether the slowdown is due to a specific host generating excessive traffic or due to a particular protocol. The analyst wants to quickly compare the traffic volume of different IP addresses and also see the protocol distribution. Which combination of Wireshark statistics tools should be used?
Select an answer first
22application · medium
An analyst is analyzing a large capture and wants to quickly spot all packets that contain a specific string in the payload, such as a malware signature. The analyst also wants to highlight these packets in a distinct color for easy visual identification. What is the most efficient approach?
Select an answer first
23expert · hard
An analyst has a capture that contains multiple HTTP sessions. The analyst needs to provide a colleague with a capture file that contains only the packets from a specific HTTP session, but the colleague also needs the raw HTTP objects from that session. What is the most efficient way to prepare both deliverables?
Select an answer first
24foundation · easy
When you use 'Follow UDP Stream' in Wireshark, what does the stream view show?
Select an answer first
25application · medium
An analyst has a large capture file and needs to provide only the packets related to a specific user's web browsing session to a colleague. The session involves multiple TCP connections over several minutes. The analyst wants to share a small, focused file. What is the best way to create this file?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

Wireshark Fundamentals GCIA Practice Questions (Page 5)

Questions 21–25

An analyst is analyzing a large capture and wants to quickly spot all packets that contain a specific string in the payload, such as a malware signature. The analyst also wants to highlight these packets in a distinct color for easy visual identification. What is the most efficient approach?

When you use 'Follow UDP Stream' in Wireshark, what does the stream view show?

An analyst has a large capture file and needs to provide only the packets related to a specific user's web browsing session to a colleague. The session involves multiple TCP connections over several minutes. The analyst wants to share a small, focused file. What is the best way to create this file?

Keep studying — Traffic Analysis and Tools