CVF 1085 Assessment Questions
In the trace file shown above, Wireshark's time display format is set to Seconds Since Beginning of Capture. Which statement about this trace file is correct? The Time column has been sorted. Packet 5 arrived 0.034876 seconds before Packet 6. The timestamps of Packet 1 through Packet 5 are invalid. Packet 11 arrived 0.053866 seconds later than Packet 6.
Packet 11 arrived 0.053866 seconds later than Packet 6.
Which statement about the Coloring Rules configuration shown above is correct? All the coloring rules listed are based on capture filters. The Clear button will restore the coloring rules to the default set. HTTP packets with the reset bit set on will be colored based on the HTTP coloring rule. UDP packets containing checksum errors will be displayed based on the UDP coloring rule
The Clear button will restore the coloring rules to the default set.
Comparison and logical operators enable you to combine multiple display filters to further define the traffic of interest
True
Custom columns can be added to and rearranged in the Packet List pane
True
Several dissectors may be applied to a single packet. True False
True
The Conversations window shown above includes 239.255.255.250 as an endpoint.
True
The MAC name resolution process resolves the first 3 bytes of the MAC address to the OUI value contained in Wireshark's manuf file.
True
You can use Wireshark's Expressions to build display filters.
True
NAT devices perform routing functions as well as name resolution functions.
False
Port numbers set in the HTTP Preferences window for HTTP or HTTPS traffic are temporary settings.
False
The UDP header checksum calculation is required for all UDP-based communications.
False
The first two packets of a single TCP handshake process can be used to determine the long term average round trip latency time between hosts.
False
The following capture filter will capture all FTP traffic on port 21 regardless of the destination or source host. host www.wiresharkbook.com and port 21
False
When you select Prepare a filter, the filter is immediately applied to the traffic.
False
Wireshark supports both capture filter macros and display filter macros
False
Which statement about marked packets is true? Marked packets can be used to generate display filters. Marked packets are automatically saved in a temporary file Marked packets are only temporarily marked. Marked packets can be created using coloring rule settings.
Marked packets are only temporarily marked.
Which item can be saved with a Wireshark profile? preference settings most recent IO Graph settings services file editcap scripts
preference settings
Which of these filters can be used as either a capture filter or a display filter? dns udp dhcp broadcast
udp
Network analyzers may cause security concerns because they can be used maliciously to listen in on unencrypted network traffic.
True
Packet timestamps are saved inside pcap and pcap-ng files so the packet timestamps can be displayed when the file is opened again.
True
The Frame section of a packet always indicates which coloring rule has been applied to the packet
True
The cfilters file can be shared with other WireShark users by copying the file into another host's personal preferences folder
True
The filter shown above will display all ARP packets as well as all TCP packets seen by Wireshark.
True
The location of Wireshark personal preference files is listed under Help | About Wireshark | Folders.
True
When you disable the TCP protocol decoding process, applications that use TCP (such as HTTP and FTP) will not be decoded.
True
Wireshark can playback encrypted VoIP conversations
True
Wireshark contains several pre-defined columns that can be quickly added to the Packet List pane by right-clicking on a field in the Packet Details pane
True
Wireshark's .pcapng format enables meta data to be saved with a trace file.
True
Wireshark's Status Bar indicates the number of packets shown after a display filter is applied.
True
Wireshark's default set of display filters are saved in a file called dfilters in the global configuration directory.
True
Wireshark's network name resolution process references Wireshark's hosts file before generating inverse DNS queries to resolve IP addresses to host names.
True
Wireshark's pcapng format enables meta data to be saved with a trace file
True
You can reorder the filters contained in the dfilters file by manually editing the dfilters text file.
True
Which capture filter would capture traffic to and from TCP ports 20 through 25? tcp port 20-25 tcp.port > 19 && tcp.port < 26 tcp port gt 19 and tcp port lt 26 tcp portrange 20-25
tcp portrange 20-25
Which display filter shows all the TCP Expert Infos warnings and notes? expert.all tcp.errors tcp.analysis.flags expert.info.composite
tcp.analysis.flags
Display filters cannot be applied during the capture process.
False
Multicasts and broadcasts are not listed in the Endpoints window because they cannot be assigned to a host.
False
The Conversations window shown above indicates that there are two unique IP endpoints running over three Ethernet addresses.
False
The Protocol Hierarchies window lists all the protocols and applications dissected by Wireshark even if those protocols or applications were not seen in a trace file.
False
The Protocol Hierarchy Statistics window shown above indicates that 10.53% of the IP traffic is ARP.
False
The Time Reference setting is saved permanently with the trace file.
False
The ip.addr != 192.168.0.2 display filter shows all packets except ones that contain the address 192.168.0.2 in the source or destination IP address fields.
False
Time Reference packets are permanently set to a timestamp of 00:00:00 in a trace file.
False
UDP, TCP and ARP packets are counted in the IP Protocol Types statistic.
False
Wireshark's Epoch time display format is based on the time since January 1 00:00:00 of 2000.
False
Wireshark's HTTP packet counter lists the HTTP request types such as EHLO and RETR.
False
You can edit the services file to change Wireshark's OUI display value from one manufacturer name to another
False
You can sort the Time column to identify packets that have a large delay between them when you have set the Time column to Seconds Since Epoch.
False
Display filters can be created based on the contents of fields that do not actually exist in a packet such as the Time Since Referenced or First Packet field.
True
ICMP Type 3/Code 4 packets (Destination Unreachable/Fragmentation Needed, but Don't Fragment Bit was Set) may indicate that a router along a path cannot forward a packet.
True
If you want to view decrypted SSL/TLS traffic, a valid RSA key setting is required prior to using Follow SSL Stream.
True
Which link layer interface is used to capture wired network traffic when Wireshark is running on a Linux host? WinPcap AirPcap dumpcap libcap
libcap
Your traffic contains many TCP retransmissions during an HTTP communication. Which of the coloring rules shown above would these packets match? HTTP Bad TCP TCP RST WLAN Retries
Bad TCP
Which format is used by capture filters? Berkeley Packet Filtering (BPF) format libpcap format color filter format editcap format
Berkeley Packet Filtering (BPF) format
How can you quickly identify all WLAN BSSIDs seen in a trace file? Open Statistics | WLAN Traffic Sort on the MAC header type field value Open Statistics | Summary Apply a wlan display filter
Open Statistics | WLAN Traffic
How do you determine which Profile is in use while you are capturing traffic? Examine the Wireshark Title Bar. Open and examine Preferences | Interface. Examine the Profile column in the Status Bar Expand and examine the Frame information.
Examine the Profile column in the Status Bar
All WLAN adapters supported by WinPcap can go into monitor mode
Fals
A trace file that is captured on a Wireshark system in Sydney, Australia and emailed to a Wireshark system in London, England will appear with the same Date/Time of Day value to both analysts if both Wireshark systems have correct local time zone settings.
False
Aggregating taps capture bi-directional full-duplex traffic and forward each direction of traffic to separate outbound ports.
False
Any display filters created and saved while viewing the trace file shown above will be saved in the "Default" profile directory.
False
Based on the image shown above, Wireshark's time display format is set to Seconds Since Beginning of Capture.
False
By default, Wireshark uses the Type of Service interpretation in the IP header instead of the DiffServ (Differentiated Services) interpretation.
False
Conversations colored using the right-click coloring method will remain colored when the trace file is opened on another Wireshark system.
False
Display filter macros can be shared by copying the dfilters file from one Wireshark system to another.
False
Display filters and capture filters can be interchanged because they use the same syntax.
False
Which communication can be used by a host to dynamically join a multicast group? Multicast DNS (mDNS) Open Shortest Path First (OSPF) Internet Group Management Protocol (IGMP) Protocol Independent Multicast (PIM)
Internet Group Management Protocol (IGMP)
What is the most efficient method for saving non-contiguous packets in a trace file? Mark the packets and choose to save the marked packets. Apply a capture filter for each packet and save all colored packets. Right click and copy the packets individually to a new instance of Wireshark. Open each packet in a new window and save them under the same file name.
Mark the packets and choose to save the marked packets.
How do you quickly spot large gaps in time between packets in a trace file containing 10,000 packets? Sort the packets based on the Time Since Reference or First Frame in the frame details section Set the Time column to Seconds Since Epoch and scroll through the trace file. Open and examine the Notes section of Wireshark Expert Infos window Set the Time column to Seconds Since Previously Displayed Packet and sort the Time column
Set the Time column to Seconds Since Previously Displayed Packet and sort the Time column
Which Wireshark feature provides an overview of saved or unsaved packets such as the time elapsed from the start to the end of the trace and total bytes in the trace file? IO Graphs Flow Graphs Summary Statistics Expert Info Composite
Summary Statistics
Which statement about the TCP stream shown above is correct? The HTTP client will load the page from cache. The HTTP client sent an HTTP GET request for the default page The HTTP server refused the client's TCP connection attempt. The HTTP server redirected the client's request to another server
The HTTP client sent an HTTP GET request for the default page
Which statement about the Coloring Rules configuration shown above is correct? The HTTP coloring rule will identify HTTP and SSL/TLS traffic. The UDP coloring rule will be applied to all normal DHCP traffic TCP packets with incorrect checksums will be colorized based on the Checksum Errors coloring rule. The TCP SYN/FIN coloring rule will identify packets that have both the SYN and FIN bits set to 0 in a packet
The UDP coloring rule will be applied to all normal DHCP traffic
Which statement about the highlighted capture filter shown above is correct? The filter will only capture local broadcast traffic. The filter is based on the Berkeley Packet Filter (BPF) format. The filter will capture all traffic to and from D4:85:64:A7:BF:A3. The filter is using Wireshark's display filter syntax
The filter is based on the Berkeley Packet Filter (BPF) format.
Which statement about the following display filter is true? eth.src[4:2] == 06:33 The number 2 indicates that Wireshark is looking for a two byte value. The number 4 indicates that Wireshark is looking at the first four bytes of the Ethernet header. The value 06:33 indicates that Wireshark is looking for Ethernet source addresses starting with 06:33. The value 06:33 indicates that Wireshark is looking six bytes into the Ethernet header for the value 33.
The number 2 indicates that Wireshark is looking for a two byte value.
Display filters applied to a trace file before opening the Protocol Hierarchy Statistics window are automatically applied to the Protocol Hierarchy results displayed.
True
Which statement about following TCP streams is correct? You must filter on a TCP conversation before following the stream. You must capture the TCP handshake process to follow a TCP stream An endpoint filter is created when you follow any stream This feature uses the TCP Stream Index value.
This feature uses the TCP Stream Index value.
Which statement about the highlighted capture filter shown above is correct? This filter is illogical. DNS PTR queries will not be captured. Only UDP packets will be captured using this filter ARP packets to or from the DNS server will not be captured
This filter is illogical.
A switch will forward traffic out all ports if it does not have a MAC table entry for the target.
True
AirPcap adapters can be used to expand Wireshark's ability to capture wireless network traffic in a Microsoft Windows environment.
True
By default, basic switches forward broadcasts and multicasts out all switch ports.
True
Changing the Filter display max. list entries value in Wireshark's Preferences window enables you to alter the number of recently created display filters that Wireshark shows in the drop-down list.
True
Columns can be right or left aligned by right clicking on their heading in the Packet List pane
True
Which statement about capture filters is correct? Capture filters are used for coloring rules. Wireshark includes a default set of capture filters. Capture filters can be applied after the capture process begins. Capture filters can be applied while you are opening a trace file.
Wireshark includes a default set of capture filters.
mc007-1.jpgWhich statement about the Preferences setting shown above is correct? Wireshark may generate DNS PTR queries to resolve host names. Wireshark may generate port queries to ietf.org to resolve transport names. Wireshark may generate OUI queries to ieee.org to resolve MAC addresses. Wireshark may generate mDNS queries to resolve 500 host names simultaneously
Wireshark may generate DNS PTR queries to resolve host names.
Which statement about the settings shown in the Preferences window above is correct? The Protocol Hierarchy window will launch when the capture is started Wireshark will only capture traffic to the local adapter's broadcast or multicast addresses Wireshark will use inverse name queries to resolve local host addresses to IP addresses No interface is available.
Wireshark will only capture traffic to the local adapter's broadcast or multicast addresses
Which statement about the Capture Options window shown above is correct? Wireshark will resolve IP addresses to host names Wireshark will scroll to display the most recent packet captured. Wireshark will attempt to resolve OUI values for all MAC addresses. Wireshark will automatically stop capturing packets after two files have been saved
Wireshark will scroll to display the most recent packet captured.
Which display filter is used to view all DHCPv4 traffic? bootp dhcpv4 tcp.port==68 ip.addr==[address_of_dhcp_server]
bootp
Which traffic type may be seen when you connect Wireshark directly to a switch without configuring port spanning or port mirroring? noise and interference broadcast traffic frames that contain CRC errors DNS queries from all hosts
broadcast traffic
What is the default name of the capture filter file? capture.txt capturefilters.txt cfilters cformat
cfilters
Which Wireshark element can be created using the display filter syntax? ACL rules capture filters coloring rules reference packets
coloring rules
What is the purpose of creating Wireshark profiles? dynamically create a hosts file based on saved trace files create a manageable database of packets for use in third-party programs discover and test WEP/WPA keys and pass phrases for traffic decryption customize Wireshark for more efficient analysis in specific environments
customize Wireshark for more efficient analysis in specific environments
Which feature is only available with promiscuous mode operation? enables an interface to capture packets that are sent to any MAC address enables an interface to capture packets addressed to broadcast and multicast addresses enables a WLAN adapter to capture packets regardless of the SSID value enables an interface to capture gratuitous ARP request packets
enables an interface to capture gratuitous ARP request packets
What is the purpose of the gratuitous ARP process? perform connectivity tests at periodic intervals offer multicast MAC address resolution services broadcast the local MAC address to local routers identify duplicate IP addresses on the network
identify duplicate IP addresses on the network
Which packet type may be transmitted by Wireshark when you enable network name resolution? DHCP requests UDP multicasts ping broadcasts inverse DNS queries
inverse DNS queries
Which filter can be used as a coloring rule? tcp port 25 portrange 21-25 udp port 161 ip.ttl < 20
ip.ttl < 20
What does Wireshark's UDP Multicast Streams burst measurement interval depict? total time length of a burst set of multicasts timing between separate multicast burst sets number of multicast packets within a specific number of milliseconds number of different multicasts groups seen within a specific number of milliseconds
number of multicast packets within a specific number of milliseconds
Which of the following methods can be used to avoid the "needle in a haystack issue" when analyzing network traffic? span all ports of a core switch use Tshark to capture to file sets place the analyzer appropriately only capture traffic on wired networks
place the analyzer appropriately
Which address type can be mapped with Wireshark's GeoIP mapping services? public IP addresses MAC and IP addresses broadcast and multicast addresses private IP addresses
public IP addresses
Which traffic characteristic is commonly seen when analyzing database record transfers? multicast responses small packet sizes large delays between transmissions separate connections for each record
small packet sizes