Covers Wireshark file operations and packet search, traffic capture methods, capture versus display filters, interface profiles, dissecting protocols like Ethernet, ARP and IPv4, and troubleshooting.
12 free sample questions126 in the full practice test
Utilize Key Features of Wireshark · File Operations and Export
An analyst needs to share a capture file with a colleague and wants to add explanatory text to specific packets indicating where an anomaly begins. Which file format and approach must be used?
Answer and explanation
Correct answer: A
The pcapng (PCAP Next Generation) format supports advanced features not available in the legacy pcap format, including the ability to add comments to individual packets. If you try to add a packet comment in a standard pcap file, Wireshark will prompt you to save the file in pcapng format.
Q2Question 2
IntermediateMultiple answers
Utilize Key Features of Wireshark · Find Packet and Time Management
A network engineer is measuring the response time of a database server. They want to see the exact time elapsed between an SQL query packet and the corresponding SQL response packet. Which TWO time display formats or features would be most appropriate? (Select TWO)
Answer and explanation
Correct answers: B, C
If a display filter is applied to show only the specific query and its response, 'Seconds Since Previously Displayed Packet' (Delta Time) will show the exact time elapsed between the two packets.
Setting a Time Reference on the specific query packet resets the clock to zero for that packet. Any subsequent packets, including the response, will show the exact time elapsed since that specific query.
Q3Question 3
Advanced
Utilize Key Features of Wireshark · Find Packet and Time Management
An incident response team receives a 5GB trace file containing raw traffic from a compromised network segment. Upon opening the file in Wireshark, the application becomes severely unresponsive, and the status bar indicates it is taking an abnormally long time to load. The analyst notices reverse DNS queries are actively leaving their workstation. What is the most effective way to resolve this performance issue?
Answer and explanation
Correct answer: D
When network name resolution is enabled, Wireshark attempts to resolve every unique IP address in the capture file to a hostname by querying the local DNS server. In a 5GB file with thousands of unique IPs, this generates massive concurrent DNS queries, causing severe interface lag and potential network congestion. Disabling it immediately restores performance.
flowchart TD
A[Open 5GB PCAP] --> B{Network Name Resolution Enabled?}
B -->|Yes| C[Wireshark sends thousands of DNS PTR queries]
C --> D[Application freezes waiting for DNS timeouts]
B -->|No| E[IP addresses displayed natively]
E --> F[Fast loading and analysis]
Q4Question 4
Intermediate
Utilize Key Features of Wireshark · File Operations and Export
During an incident response investigation, an analyst suspects malware was downloaded via unencrypted HTTP. They have a 10GB capture file and want to extract the actual executable file to their local disk for malware analysis. Which Wireshark feature is designed specifically for this task?
Answer and explanation
Correct answer: A
The 'Export Objects' feature allows analysts to reconstruct and save files that were transferred over supported protocols (like HTTP, SMB, TFTP) directly to their local hard drive. This is the exact tool designed for extracting payloads like downloaded executables from a packet capture.
Q5Question 5
Beginner
Utilize Key Features of Wireshark · Statistical Analysis Tools
True or False: In the Wireshark Packet Details pane, fields enclosed in square brackets (e.g., [SEQ/ACK analysis]) represent actual bytes captured directly from the network wire.
Answer and explanation
Correct answer: B
In Wireshark, any field enclosed in square brackets [ ] indicates that the information was generated or calculated by Wireshark's protocol dissectors. These fields do not represent actual raw bytes captured from the network wire, but rather contextual information provided to assist the analyst (e.g., [Time since previous frame], [SEQ/ACK analysis]).
Q6Question 6
Intermediate
Utilize Different Methods of Capturing Traffic · Capture Methods Comparison
A network engineer is preparing to capture traffic on a heavily utilized 10 Gbps full-duplex core switch link. They need to ensure that physical layer errors (like runts and CRCs) are captured and that no packets are dropped due to oversubscription. Which capture method is the BEST choice?
Answer and explanation
Correct answer: A
A Hardware Network Tap is an inline physical device that copies all traffic, including physical layer errors (runts, CRCs, giants), directly to a monitoring port. Because a 10 Gbps full-duplex link can theoretically generate 20 Gbps of traffic, a properly sized Tap ensures zero dropped packets, unlike a SPAN port which can become oversubscribed and silently drop packets.
Register free for 6 more questions
Or unlock all 126 WCA-101 questions with explanations, timed mode and flashcards.
