100-150 Question 211
Select 2You are troubleshooting a network issue using Wireshark. You want to capture packets from a specific interface and save the capture file for later analysis. After opening Wireshark, what are the correct steps to perform this task?
- A
Select the appropriate network interface and click 'Start' to begin capturing packets.
- B
Use the 'File' menu to open a previously saved capture file before starting a new capture.
- C
Click 'Capture' in the menu bar, then select 'Options' to configure the capture file's save location.
- D
While capturing, click 'File' > 'Save As' to save the packet capture to a file.
- E
Stop the capture by clicking the red square icon, then use 'File' > 'Save' to save the captured packets.
Show answer and explanation
Correct answers: A, E
Explanation
To capture and save packets in Wireshark, you first need to select the appropriate network interface and start the capture. Once the necessary packets have been captured, stop the capture and save the data to a file using 'File' > 'Save'. This ensures the file is complete and ready for analysis.
- A. Correct.
This is correct. Selecting the appropriate network interface and starting the capture is the first step to capturing packets.
- B. Incorrect.
This is incorrect. Opening a previously saved file does not help in starting a new packet capture.
- C. Incorrect.
This is incorrect. Configuring the save location is not a mandatory step to saving a capture, and this is not an intuitive part of the packet capture process.
- D. Incorrect.
This is incorrect. Saving a capture while it is still running may result in an incomplete or invalid file. It is better to stop the capture first.
- E. Correct.
This is correct. After stopping the capture, you can save the captured packets using the 'File' > 'Save' option.