During analysis of a pcap, an analyst notices that a TCP stream contains a file transfer that is split across multiple packets. The application-layer protocol uses a 4-byte header: 2 bytes for a message type and 2 bytes for the payload length. The analyst needs to reassemble the full file. What is the first step the analyst should take?

Identify the message type field to determine the file type before reassembly

Decode the payloads individually and concatenate them in any order

Follow the TCP stream in Wireshark to reassemble the session and then parse the application headers

Filter for the specific port and export all packets as a raw binary file

GIAC Network Forensic Analyst

Domain 2Objective 2

Network Protocol Reverse Engineering GNFA Practice Questions (Page 10)

Part of the Network Traffic Analysis and Visualization domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 10–16 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 46–47

46application · medium
During analysis of a pcap, an analyst notices that a TCP stream contains a file transfer that is split across multiple packets. The application-layer protocol uses a 4-byte header: 2 bytes for a message type and 2 bytes for the payload length. The analyst needs to reassemble the full file. What is the first step the analyst should take?
Select an answer first
47foundation · easy
In TCP's state machine, which state does a client enter after sending a SYN segment to initiate a connection?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Network Protocol Reverse Engineering GNFA Practice Questions (Page 10)

Questions 46–47

In TCP's state machine, which state does a client enter after sending a SYN segment to initiate a connection?

Keep studying — Network Traffic Analysis and Visualization