How do you manually mark a specific packet in Wireshark to make it stand out in the packet list?

Right-click the packet and select 'Mark/Unmark Packet'

Select the packet and press Delete

Apply a coloring rule to the packet

An analyst has identified a suspicious HTTP session in a capture and wants to save the raw HTTP objects (e.g., files downloaded) for malware analysis. The analyst also wants to save the entire TCP stream for that session as a separate capture file. What is the correct sequence of actions?

Use File > Export Objects > HTTP to save the objects, then use File > Export Specified Packets with a display filter for the TCP stream.

Use Statistics > Conversations and export the selected conversation.

Use File > Save As to save the entire capture, then use File > Export Objects > HTTP.

Use Follow TCP Stream and then copy the raw bytes to a file.

An analyst is investigating a possible data exfiltration where a host is sending large amounts of data to an external IP over HTTPS. The analyst wants to identify all TCP streams where the total payload size exceeds 1 MB. The analyst also wants to see the endpoints involved. Which approach is most effective?

Use Statistics > Endpoints and sort by bytes.

Use Follow TCP Stream on each packet to check the size.

Use Statistics > Conversations, sort by bytes, and apply a display filter for tcp.port == 443.

Use a display filter 'tcp.len > 1000000' and view the packet list.

An analyst is reviewing a capture from a network where a host is suspected of scanning multiple ports on a server. The analyst wants to see a summary of all TCP conversations between the scanning host and the server, including the number of packets and bytes exchanged. Which Wireshark feature provides this information directly?

Statistics > Conversations, filtered to TCP

Statistics > Protocol Hierarchy

An analyst is reviewing a capture with thousands of packets and wants to visually distinguish all packets that contain a specific string in the payload. The analyst wants these packets to appear in a bright color so they are easy to spot. Which Wireshark feature should be configured?

Export the packets containing the string to a new file

Use the IO Graph to plot packets containing the string

Create a coloring rule with a display filter that matches the string

Use the Follow Stream feature to highlight the string

GIAC Certified Intrusion Analyst

Domain 2Objective 4

Wireshark Fundamentals GCIA Practice Questions (Page 7)

Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 31–35

31foundation · easy
How do you manually mark a specific packet in Wireshark to make it stand out in the packet list?
Select an answer first
32application · medium
An analyst has identified a suspicious HTTP session in a capture and wants to save the raw HTTP objects (e.g., files downloaded) for malware analysis. The analyst also wants to save the entire TCP stream for that session as a separate capture file. What is the correct sequence of actions?
Select an answer first
33expert · hard
An analyst is investigating a possible data exfiltration where a host is sending large amounts of data to an external IP over HTTPS. The analyst wants to identify all TCP streams where the total payload size exceeds 1 MB. The analyst also wants to see the endpoints involved. Which approach is most effective?
Select an answer first
34application · medium
An analyst is reviewing a capture from a network where a host is suspected of scanning multiple ports on a server. The analyst wants to see a summary of all TCP conversations between the scanning host and the server, including the number of packets and bytes exchanged. Which Wireshark feature provides this information directly?
Select an answer first
35application · medium
An analyst is reviewing a capture with thousands of packets and wants to visually distinguish all packets that contain a specific string in the payload. The analyst wants these packets to appear in a bright color so they are easy to spot. Which Wireshark feature should be configured?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

Wireshark Fundamentals GCIA Practice Questions (Page 7)

Questions 31–35

How do you manually mark a specific packet in Wireshark to make it stand out in the packet list?

An analyst has identified a suspicious HTTP session in a capture and wants to save the raw HTTP objects (e.g., files downloaded) for malware analysis. The analyst also wants to save the entire TCP stream for that session as a separate capture file. What is the correct sequence of actions?

An analyst is reviewing a capture with thousands of packets and wants to visually distinguish all packets that contain a specific string in the payload. The analyst wants these packets to appear in a bright color so they are easy to spot. Which Wireshark feature should be configured?

Keep studying — Traffic Analysis and Tools