100-150 Question 213
Select 4You are troubleshooting an intermittent connectivity issue on a workstation in your network. To capture network traffic for analysis, you decide to use Wireshark. Which steps should you take to perform the packet capture and save it to a file?
- A
Start Wireshark and select the appropriate network interface to capture traffic.
- B
Click the 'Stop' button once you have captured sufficient traffic.
- C
Use the 'Statistics' menu to automatically save the capture file.
- D
Go to 'File' > 'Save As' to save the capture to a specific file.
- E
Start capturing packets by clicking the 'Analyze' menu and selecting 'Begin Capture'.
- F
Ensure you have administrative privileges to access the network interface for capturing.
Show answer and explanation
Correct answers: A, B, D, F
Explanation
To perform a packet capture with Wireshark and save it to a file, you must first start Wireshark and select the appropriate network interface. Once enough data has been captured, you stop the capture and save the file using 'File' > 'Save As'. Additionally, administrative privileges are often required to access network interfaces for capturing traffic. Understanding these steps ensures effective use of Wireshark for troubleshooting.
- A. Correct.
Correct. Selecting the correct network interface is necessary to capture the traffic from the desired network.
- B. Correct.
Correct. Stopping the capture ensures you can work with a defined set of data for analysis.
- C. Incorrect.
Incorrect. The 'Statistics' menu is used to analyze captured data but does not provide an option to save the capture file.
- D. Correct.
Correct. Using 'File' > 'Save As' is the correct method to save the capture data to a file for future analysis.
- E. Incorrect.
Incorrect. Packet capture is started by selecting the network interface and clicking the 'Start Capturing Packets' button, not through the 'Analyze' menu.
- F. Correct.
Correct. Administrative privileges are required to access the network interface for capturing traffic.