Changes between Version 5 and Version 6 of netsec2018wireshark

Timestamp:

Jun 10, 2018, 5:56:21 PM (6 years ago)

Author:

admin

Comment:

--

netsec2018wireshark

@@ -79 +79 @@
  - '''!(arp or icmp or dns)''' [masks out arp, icmp, dns, or whatever other protocols may be background noise. Allowing you to focus on the traffic of interest]
 
-=== 
+=== Analysing ===
+
+Download the sample packet capture files from here. Open them from wireshak to analyse them. Go to '''File>Open''' and select tha pcap file to be open.
+
+'''Telnet.pcap'''
+ - Wht is the Username and Password?
+ - What did the User do after log in?
+Open the file. Filter all the telnet traffic. Go to Analyse>Follow>TCP Stream.
+
+'''massivesyn.pcap'''
+ - Is this an attack? If so what type of an attack?
+Open the file, Go to Statistics>Coversation. Check for the Type of packet, Sourse IP and the duration
+
+'''chat.dump'''
+
+Open the file. Go to Analyse>Follow>TCP Stream.
+
+ - What are the email addresses of the chatters?
+ - What were they planning to do?
+
+'''ftp.pcap'''
+
+Open the file. Statistics>Coversation.  Click TCP. Check the Statistics. Go to Analyse>Follow>TCP Stream
+
+ - What is the IP address of the FTP server and the Client?
+ - What is the error code 530?
+
+'''foobar.pcap'''
+
+Open the file. Statistics>Coversation and check for source and destination IP and port. Go to Statistics>Protocol Hierarchy
+
+ - What is the protocol use TCP 6346?
+ -  What could be this scenario?
+
+'''convertinfo.pcap'''
+
+Open the file. Statistics>Coversation and check for packet length. 
+
+ - Ids this a normal icmp packet?
+
+'''sip.pcap'''