Wireshark Cards Practice Exam

Question 1 Wireshark Cards

What is the default capture file name pattern?

995 No default, user specifies or uses ring buffer ppp Use timestamps, IP addresses, and protocol information to link related events

Question 2 Wireshark Cards

How to filter for SMB (Server Message Block) traffic?

wlan.fc.type_subtype == 1 udp.port == 53 smb dns.flags.rcode == 2

Question 3 Wireshark Cards

What is the Go to Packet feature?

ospf.msg == 1 A feature that marks packets for easy identification (marked packets are highlighted). A feature that jumps to a specific packet by number. ospf

Question 4 Wireshark Cards

What is the Text2pcap tool?

tcp.flags.syn == 1 && tcp.flags.ack == 0 && tcp.window_size < 1024 A command-line tool for converting hexadecimal dump text files into pcap capture files. tcp.window_size < 1000 dns.qry.type == 12

Question 5 Wireshark Cards

How do you filter for packets with DHCP message type ACK?

ssh cdp.deviceid bootp.option.type == 53 && bootp.option.value == 5 Filter for http.authorization, examine base64 encoded credentials, check for plaintext passwords

Question 6 Wireshark Cards

What filter shows packets with OSPF (Open Shortest Path First) protocol?

ospf Statistics > HTTP > Packet Counter or Request/Response Sequences ip.frag_offset > 0 dns.flags.recdesired == 1

Question 7 Wireshark Cards

How do you analyze wireless network traffic?

frame.number >= 100 && frame.number <= 200 websocket.masked == 1 Capture on wireless interface, filter for 802.11 frames lldp.tlv.port.id

Question 8 Wireshark Cards

How to filter for packets with iSCSI SCSI command?

dns.flags.recdesired == 1 iscsi.opcode == 0x01 cdp.deviceid bootp.option.type == 53 && bootp.option.type == 5

Question 9 Wireshark Cards

What is the filter for HTTPS/TLS traffic?

View > Name Resolution > Resolve MAC Addresses tls or ssl tcp.port == 80 dns.count.auth_rr > 0

Question 10 Wireshark Cards

How do you filter for packets with NetBIOS datagram service?

nbds dns.qry.name == "example.com" Filter for openvpn, ipsec, or pptp protocols A feature that jumps to a specific packet by number.

Question 11 Wireshark Cards

What is the Name Resolution feature?

mpls A feature that resolves IP addresses to hostnames, MAC addresses to vendor names, and port numbers to service names. ipv6.nxt == 6 161

Question 12 Wireshark Cards

How to filter for packets with TLS version 1.2?

! or not icmp.type == 14 tls or ssl tls.version == 0x0303

Question 13 Wireshark Cards

What is the Preferences dialog?

A visual representation of packet flow between hosts http2.type == 6 icmp.type == 13 A dialog for configuring Wireshark settings including protocols, appearance, capture options, and name resolution.

Question 14 Wireshark Cards

What filter shows DNS responses with NOERROR?

frame.number >= 100 && frame.number <= 200 dns.flags.rcode == 0 frame.len > 1000 frame.time_relative > 10.0

Question 15 Wireshark Cards

What filter shows packets with RTP sequence number?

vlan.id == 100 rtp.seq arp.hw.size == 6 ldap

Question 16 Wireshark Cards

How to filter for packets with NFS readdir?

tshark -r input.pcapng -T fields -e ip.src -e ip.dst nfs.proc == 16 frame.number >= 100 && frame.number <= 200 smb2.cmd == 5

Question 17 Wireshark Cards

How do you monitor cloud service traffic?

http.request.method == "GET" http.content_type contains "json" Filter by destination IP ranges, examine TLS SNI fields fcoe.fc.ct.cmd == 0x22

Question 18 Wireshark Cards

What filter shows potential SYN flood attack?

http.response.code >= 300 && http.response.code < 400 tcp (captures only TCP traffic) tcp.analysis.retransmission tcp.flags.syn == 1 && tcp.flags.ack == 0

Question 19 Wireshark Cards

What are the Expert System severity levels?

Chat, Note, Warning, and Error, each indicating different levels of issues or information. dns.qry.class == 3 445 A list showing name resolution results for IP addresses, MAC addresses, and port numbers in the capture.

Question 20 Wireshark Cards

How to filter for packets with a specific time delta (time between packets)?

frame.time_delta > 1.0 Use Statistics > Conversations, sort by packets/bytes, look for unusual ports 389 http.request.uri contains "Range:"

Question 21 Wireshark Cards

What does I/O Graph show?

mpls.label A graphical representation of packet/byte rates over time http.response.code >= 300 && http.response.code < 400 http.user_agent contains "Chrome"

Question 22 Wireshark Cards

How do you filter for packets with TLS handshake certificate?

http.content_type contains "xml" tls.handshake.type == 11 dns.flags.response == 0 smb2.cmd == 9

Question 23 Wireshark Cards

How do you filter for packets with DHCP message type discover?

Use time-based filters: frame.time >= "2024-01-01 00:00:00" && frame.time <= "2024-01-01 23:59:59" http.host matches ".*example\.com.*" 993 bootp.option.type == 53 && bootp.option.value == 1

Question 24 Wireshark Cards

What is the Capture Filter syntax?

A feature that jumps to a specific packet by number. ospf.msg == 2 icmp.type == 5 && icmp.code == 1 BPF (Berkeley Packet Filter) syntax, different from display filter syntax (e.g., "host 192.168.1.1" instead of "ip.addr == 192.168.1.1").

Question 25 Wireshark Cards

What filter shows packets with WebSocket opcode binary?

File > Export Packet Bytes quic.long.packet_type == 2 Automatically identifies potential network problems, protocol errors, and unusual patterns in captured packets. websocket.opcode == 2

Question 26 Wireshark Cards

What does Expert Info 'Zero window' mean?

The receiver's TCP window is zero, indicating buffer full bgp.type == 4 A feature that marks packets for easy identification (marked packets are highlighted). http.request.uri contains "Range:"

Question 27 Wireshark Cards

What is the filter for packets with OSPF link state acknowledgment?

bgp.type == 2 ospf.msg == 5 View > Time Display Format > Seconds Since Beginning of Capture nfs.proc == 9

Question 28 Wireshark Cards

What is the default RTSP port?

ipv6.fragment View > Coloring Rules icmp.type == 13 554

Question 29 Wireshark Cards

What is the Endpoints window used for?

To view statistics about individual network endpoints (IP addresses, MAC addresses, etc.) and their traffic. websocket.opcode == 9 445 ldap

Question 30 Wireshark Cards

How do you filter for TCP packets with the ACK flag set?

A feature that creates multiple capture files in rotation, useful for long-term captures with limited disk space. wlan.fc.type_subtype == 0 sip.Status-Code == 200 tcp.flags.ack == 1

Question 31 Wireshark Cards

How do you access Flow Graph?

Statistics > Flow Graph tshark -r input.pcapng -Y "http" Capture on wireless interface, filter for 802.11 frames http.content_type contains "json"

Question 32 Wireshark Cards

What is the default HTTP port?

quic.short.header 80 http.request.method == "DELETE" eigrp

Question 33 Wireshark Cards

How do you identify network loops?

http.request.method == "OPTIONS" http.content_type contains "xml" Look for duplicate packets, check TTL values decreasing, examine routing patterns smb2.cmd == 8

Question 34 Wireshark Cards

What filter shows SNMP traffic?

tcp.options.mss_val > 0 snmp wlan.fc.type_subtype == 11 ipv6.nxt == 6

Question 35 Wireshark Cards

How to filter for packets with WebSocket opcode text?

dns.flags.authentic == 1 websocket.opcode == 1 udp http.request.method == "POST"

Question 36 Wireshark Cards

How to filter for packets with HTTP method HEAD?

http.request.method == "HEAD" dns.count.add_rr > 0 stp.root.priority tls.handshake.type == 12

Question 37 Wireshark Cards

How do you access the Conversations window?

Statistics > Conversations mpls dns.flags.authentic == 1 A feature that tells Wireshark to interpret traffic on a specific port as a different protocol than the default.

Question 38 Wireshark Cards

How do you filter for BGP traffic?

editcap -c 1000 input.pcapng output.pcapng tcp.flags.rst == 1 bgp http.response.code == 407

Question 39 Wireshark Cards

What filter shows DHCP Release messages?

Statistics > Endpoints http2.type == 6 bootp.option.type == 53 && bootp.option.type == 7 infiniband.mad.mgmt_class == 5

Question 40 Wireshark Cards

How to filter for packets with Kerberos AS-REQ (authentication service request)?

kerberos.msg_type == 10 ah ssh icmpv6.type == 3

Question 41 Wireshark Cards

What filter shows packets with OSPF link state request?

smb2.cmd == 9 ospf.msg == 3 No default, user specifies or uses ring buffer frame.time >= "2024-01-01 00:00:00" && frame.time <= "2024-01-01 23:59:59"

Question 42 Wireshark Cards

Which library does Wireshark use for packet capturing on Linux/Unix?

bootp.option.type == 53 && bootp.option.type == 5 libpcap ipv6.routing.type == 0 Automatic reassembly of TCP segments into complete application data

Question 43 Wireshark Cards

What is the default IMAPS port?

Right-click a packet > Set Time Reference (toggle) editcap -c 1000 input.pcapng output.pcapng To view statistics about conversations (sessions) between two endpoints, showing packets, bytes, and duration. 993

Question 44 Wireshark Cards

What is the capture interface selection?

mpls The process of choosing which network interface to capture packets from. dns.count.add_rr > 0 ipv6.flow_label

Question 45 Wireshark Cards

How do you monitor file transfers?

ipv6.hop_limit == 64 Filter for ftp or smb, use Follow Stream to view file data dhcp.option.dhcp == 3 icmpv6.type == 135

Question 46 Wireshark Cards

What is the syntax to filter for IP address 192.168.1.1 in a display filter?

ip.addr == 192.168.1.1 A dialog for configuring Wireshark settings including protocols, appearance, capture options, and name resolution. A system that colors packets in the packet list based on predefined or custom rules to quickly identify different types of traffic. View > Coloring Rules > Export

Question 47 Wireshark Cards

How to filter for packets with EIGRP protocol?

ppp frame.number == 100 A module that decodes and analyzes a specific protocol. eigrp

Question 48 Wireshark Cards

How to filter for DHCP Request messages?

bootp.option.type == 53 && bootp.option.type == 3 123 rtcp.pt == 201 dhcp.option.dhcp == 3

Question 49 Wireshark Cards

What is the filter for packets with ARP replies?

A list of all network conversations (IP, TCP, UDP) with statistics Check I/O Graph for throughput, TCP Stream Graph for RTT, look for retransmissions and zero windows ipv6.hop_limit == 64 arp.opcode == 2

Question 50 Wireshark Cards

How do you capture with TShark and save to file?

tshark -i eth0 -w output.pcapng sip.Status-Code == 404 icmp.type == 3 && icmp.code == 2 tcp.window_size < 1000