200-201 Question 261
Select 3You are investigating a potential data breach and have been provided with a PCAP file containing suspicious network traffic. Using Wireshark, you need to extract a file transferred via HTTP in the TCP stream. Which of the following steps should be performed to extract the file successfully?
- A
Use the 'Follow TCP Stream' option in Wireshark to view the raw data of the TCP connection.
- B
Identify the correct TCP stream by filtering the traffic using 'http' as the display filter.
- C
Export the file directly by right-clicking on the packet and selecting 'Export File'.
- D
Reassemble the HTTP object by using the 'File > Export Objects > HTTP' option in Wireshark.
- E
Enable 'TCP Stream Reassembly' in the Wireshark preferences before analyzing the traffic.
Show answer and explanation
Correct answers: A, B, D
Explanation
To extract files from a TCP stream in Wireshark, you need to first identify the correct TCP stream (e.g., by filtering traffic for HTTP connections) and then use the 'Follow TCP Stream' option to analyze the data. Once identified, the file can be reassembled and extracted using the 'Export Objects > HTTP' option. These steps ensure that the transferred file is properly retrieved from the captured network traffic.
- A. Correct.
Correct. The 'Follow TCP Stream' option allows you to view the data exchanged in the TCP connection, which is critical for identifying and extracting the file.
- B. Correct.
Correct. Filtering the traffic using 'http' as a display filter helps narrow down the packets associated with HTTP traffic, making it easier to find the relevant TCP stream.
- C. Incorrect.
Incorrect. There is no direct option to 'Export File' by right-clicking on a packet in Wireshark. Files must be extracted through HTTP object reassembly or similar methods.
- D. Correct.
Correct. The 'Export Objects > HTTP' option allows you to extract reassembled HTTP objects directly from the captured traffic, which is necessary to retrieve the file.
- E. Incorrect.
Incorrect. While TCP Stream Reassembly is important, it is enabled by default in Wireshark and does not require manual configuration in most cases.