200-201 Question 262
Select 2While analyzing a PCAP file in Wireshark, you identify an HTTP stream containing a suspicious file download. You want to extract the file from the TCP stream for further analysis. Which steps should you take to successfully extract the file?
- A
Follow the TCP stream to view the raw data and save it as a file.
- B
Use the 'File > Export Objects > HTTP' option to locate and extract the file.
- C
Apply a display filter for 'http.file_data' to isolate the file data and save it.
- D
Reassemble the TCP stream manually by decoding the payload in a hex editor.
- E
Export the PCAP as a text file and search for the file data manually.
Show answer and explanation
Correct answers: A, B
Explanation
To extract files from a TCP stream in Wireshark, you can either follow the TCP stream to save the raw data or use the 'File > Export Objects > HTTP' option for HTTP-based files. These methods are efficient and designed for file extraction, while other options like manual reassembly or using display filters are either impractical or insufficient for this task.
- A. Correct.
Correct. Following the TCP stream allows you to view the raw data within the stream and save it for further analysis.
- B. Correct.
Correct. The 'File > Export Objects > HTTP' option in Wireshark is specifically designed to extract files from HTTP streams.
- C. Incorrect.
Incorrect. While 'http.file_data' is a valid filter, it does not directly provide an option to extract files.
- D. Incorrect.
Incorrect. Manually reassembling the stream in a hex editor is unnecessary and error-prone when Wireshark provides built-in tools for this purpose.
- E. Incorrect.
Incorrect. Exporting the PCAP as a text file is inefficient and not intended for file extraction.