Virtual Labs

Identifying and Investigating Various Network Attacks using Wireshark

Which Wireshark filter would you use to detect the presence of a SYN flood attack?

a: http.request Explanation

Explanation

b: tcp.flags.syn == 1 and tcp.flags.ack == 0 Explanation

Explanation

c: dns.qry.name == 'example.com' Explanation

Explanation

d: arp.opcode == 2 Explanation

Explanation

How can ARP poisoning be detected in a pcap file using Wireshark?

a: By filtering for packets where the ARP reply contains an unexpected MAC address. Explanation

Explanation

b: By analyzing DNS query responses. Explanation

Explanation

c: By looking for SYN packets without corresponding ACKs. Explanation

Explanation

d: By filtering for HTTP GET requests. Explanation

Explanation

Which type of attack might you be investigating if you filter for 'tcp.flags == 0x29' in Wireshark?

a: SYN flood attack Explanation

Explanation

b: DNS spoofing Explanation

Explanation

c: Xmas scan Explanation

Explanation

d: Man-in-the-middle attack Explanation

Explanation

How can plaintext passwords be detected in Wireshark?

a: By inspecting encrypted HTTPS packets Explanation

Explanation

b: By using filters like 'http.authbasic' or analyzing TCP streams of protocols without encryption Explanation

Explanation

c: By capturing ARP traffic Explanation

Explanation

d: By monitoring SYN packets only Explanation

Explanation

What type of network anomalies can DNS analysis in Wireshark help detect?

a: Port scanning using FIN packets Explanation

Explanation

b: DNS tunneling, spoofing, or data exfiltration Explanation

Explanation

c: SYN flood attacks Explanation

Explanation

d: ARP cache poisoning Explanation

Explanation

Why is network forensics important when using Wireshark?

a: It prevents hardware failures Explanation

Explanation

b: It ensures faster internet speeds Explanation

Explanation

c: It helps identify attack patterns, prevent data breaches, and perform post-incident investigations Explanation

Explanation

d: It automatically blocks malware Explanation

Explanation