HomeworkLib
Question

What are some specific items that an investigator might be looking for when capturing network traffic...

What are some specific items that an investigator might be looking for when capturing network traffic or analyzing an existing capture file? Describe how you could use the Filter ability of Wireshark to make this process more efficient. If you currently work with Wireshark discuss workflows you utilize.


engineering   Computer-Science   
0 0
Add a comment Improve this question Transcribed image text
Next > < Previous
Sort answers by oldest

Homework Answers

Answer #1

The investigator might be looking out at the traffic of a particular host, loss of packets, source and destination nodes of a packet, look into the files being transferred and find out any malicious activity, protocols being used like TCP, UDP or ICMP, etc.

One can use the wireshark filter options to see the packets pertaining to those options. Example filters can be searching for packets with some host, or based on the protocol, handshaking, DNS requests etc.

This is because while capturing network traffic or analyzing existing files, there are thousands of packets and looking at each of them isn't a practical option.

0 0
Add a comment
Know the answer?
Add Answer to:
What are some specific items that an investigator might be looking for when capturing network traffic...
Your Answer:

Post as a guest

Your Name:

What's your source?

Earn Coins

Coins can be redeemed for fabulous gifts.

Log In

Sign Up

Not the answer you're looking for? Ask your own homework help question. Our experts will answer your question WITHIN MINUTES for Free.
Similar Homework Help Questions

  • Analyzing Network Traffic, review the following questions and respond with answers to the questions using your...

    Analyzing Network Traffic, review the following questions and respond with answers to the questions using your critical thinking and moral reasoning skills. Using the knowledge gained by performing network traffic capturing, take a TCP connection and describe the process of communication between two hosts. Make sure you do not get bogged down by the fragmentation in your analysis, although it is important to mention this. Describe the linking of the sequence number and acknowledgment, IP addresses, along with how the...

  • In this lab, we’ll investigate the 802.11 wireless network protocol. Follow the instructions and answers questions...

    In this lab, we’ll investigate the 802.11 wireless network protocol. Follow the instructions and answers questions 7 - 10. http://gaia.cs.umass.edu/wireshark-labs/wireshark-traces.zip In this lab, we'll investigate the 802.11 wireless network protocol. Before beginning this lab, you might want to re-read Section 6.3 in the text. Since we l1 be delving a bit deeper into 802.11 than is covered in the text, you might want to check out "A Technical Tutorial on the 802.11Protocol," by Pablo Brenner (Breezecom Communications) http://www.sss-mag.com/pdf802_11tut.pdf, and "Understanding...

  • DQ1. What is an Audit Work Program (some call it Audit Program)? The audit work program...

    DQ1. What is an Audit Work Program (some call it Audit Program)? The audit work program - Email Surveillance Audit Program – What is the structure and contents including various audit steps. Find 1-2 steps in the audit program where the audit software can be used. How can audit software be used to gather evidence?. (the Audit program (Email Surveillance Audit Program details is attached). DQ3. Review the contents of the Audit Manual of Office of University Audits at University...

  • What type of market structure best describes this market? Provide specific evidence to support your claim,...

    What type of market structure best describes this market? Provide specific evidence to support your claim, including (but not limited to) the actions of the firms and the characteristics of the market. If you were Netflix, what might your future course of action be? Why? If you were Amazon, what might your future course of action be? Why? Netflix is Almost as Popular as Cable Among Young Adults % of American adults who subscribe to the following Pay-TV services, by...

  • Case Study 1: Drive-Thru Service Times @ McDonald's (McDonalds Drive-Thru Waiting Times spreadsheet) When you're on...

    Case Study 1: Drive-Thru Service Times @ McDonald's (McDonalds Drive-Thru Waiting Times spreadsheet) When you're on the go and looking for a quick meal, where do you go? If you're like millions of people every day, you make a stop at McDonald's. Known as "quick service restaurants" in the industry (not "fast food"), companies such as McDonald's invest heavily to determine the most efficient and effective ways to provide fast, high-quality service in all phases of their business. Drive-thru operations...

  • Give an specific example and describe the operation of a perpetual motion machine. Will the machine...

    Give an specific example and describe the operation of a perpetual motion machine. Will the machine work? Why or why not? Reply to the posts of at least two other students as well as comments on your own post. 13 Use the Everyday Phenomenon Box 11.2 on page 230 of the textbook as an example. Do not post this as your example, however. Everyday Phenomenon Box 11.2 Water turbine O n A Productive Pond The Situation. A local farmer consulted...

  • THE BIG D COMPANY The Big D Company of Dallas, Texas, was a family owned, conservatively...

    THE BIG D COMPANY The Big D Company of Dallas, Texas, was a family owned, conservatively managed company. For over forty years the company enjoyed slow, steady growth in reaching its current employment level of just over 200. All expansions were financed entirely out of earnings. As the company grew, its operating procedures were periodically re-examined and modified to cope with the complex problems that accompany growth. The company developed, manufactured, and sold metering and flow control devices used in...

  • A new version of the operating system is being planned for installation into your department’s production...

    A new version of the operating system is being planned for installation into your department’s production environment. What sort of testing would you recommend is done before your department goes live with the new version? Identify each type of testing and describe what is tested. Explain the rationale for performing each type of testing. [ your answer goes here ] Would the amount of testing and types of testing to be done be different if you were installing a security...

  • ACCT495 Final Project – Part 2 Fall 2019   Assignment Long-Term Asset Acquisition Bruce and Emmett (B...

    ACCT495 Final Project – Part 2 Fall 2019   Assignment Long-Term Asset Acquisition Bruce and Emmett (B & E) is considering a significant equipment replacement. B & E would like to replace some of their equipment before December 31, 2019. The equipment originally cost $500,000 and the equipment’s accumulated depreciation balance at the end of 2019 is will be $450,000. At this point the equipment is depreciated to its salvage value. Your long-term asset accountant, Boris, tells you about four equipment...

  • can Marriot make use of casual Research? if yes, how, and in what way could make...

    can Marriot make use of casual Research? if yes, how, and in what way could make use of experimentation? what specific experimental design would you recommend? please apply to the case with the example with the name of the method MARRIOTT: Marketing Research Leads to Expanded Offerings ONLINE VIDEO CASE 15.1 success. According to Gordon Lambourne, vice president, Marketing and Public Relations, the Marriott brand identity is all about commitment to service excellence, a strong focus on employees that work...

ADVERTISEMENT
Free Homework Help App
Download From Google Play
Scan Your Homework
to Get Instant Free Answers
Need Online Homework Help?
Ask a Question
Get Answers For Free
Most questions answered within 3 hours.
ADVERTISEMENT
ADVERTISEMENT