Explain how an analyst can use Wireshark to examine a browser-to-web-server exchange, and distinguish passive packet analysis from active scanning.

### Why this is right The workflow begins by capturing traffic on the interface through which the browser communicates. Filters and stream-following help the analyst focus on the web exchange, while HTTP object export can retrieve objects present in the capture. ### The concept **Passive packet analysis** means observing packets that are already moving through a point the analyst can monitor. A **display filter** narrows the packets shown, and Follow TCP Stream groups packets belonging to a conversation. **Active scanning** is different because a tool sends probes to a target and interprets its responses. Packet captures and scan results can both inform security assessment, but neither grants permission to examine a system. Sensitive capture data should be protected. ### What a good answer covers - Select the interface that carries the relevant traffic. - Apply an HTTP filter and inspect requests and responses. - Use Follow TCP Stream or Export Objects (HTTP) for focused analysis. - Explain that passive capture observes traffic, while active scanning sends probes. - State that monitoring and scanning require authorization. ### Terms - **HTTP**: Hypertext Transfer Protocol. A protocol used for web communication. - **TCP**: Transmission Control Protocol. A connection-oriented transport protocol. - **Nmap**: Network Mapper. A tool that sends probes to discover hosts or services. ### Remember Wireshark observes a permitted traffic path; an active scanner sends traffic to a target.