Fundamentals of InfoSecintermediate
Arrange these steps for an authorized Wireshark HTTP analysis in the correct order.
Answer
Select the network interface used for the traffic., Start a capture and allow relevant traffic to occur., Apply an HTTP display filter., Inspect the exchange, for example by following the TCP stream.
Explanation
### Why this is right
The analyst must capture on the interface that can see the traffic before filtering or examining it. Once packets have been captured, a filter narrows the displayed set, and stream analysis can then provide context for the exchange.
### The concept
A packet-analysis workflow moves from collection to selection to interpretation. Starting with the wrong interface may produce no useful packets. Applying a filter before relevant traffic has been captured cannot reveal a conversation that is absent from the capture. The activity should be performed only on traffic you are authorized to observe.
### The order
1. **Select the network interface used for the traffic.** This determines where Wireshark listens.
2. **Start a capture and allow relevant traffic to occur.** Packets must be collected before they can be analyzed.
3. **Apply an HTTP display filter.** Filtering reduces the visible packet set to relevant web traffic.
4. **Inspect the exchange, for example by following the TCP stream.** The selected packets can now be examined in conversation context.
### Terms
- **HTTP**: Hypertext Transfer Protocol. A protocol for web requests and responses.
- **TCP**: Transmission Control Protocol. A protocol for reliable, ordered data delivery.
### Remember
The correct analysis sequence is interface, capture, filter, inspect.
Related Questions
- Explain why computer security is described as a process rather than a product. Include the roles of technology, people, and environment.(intermediate)
- Select ALL items the review identifies as possible security risks or losses.(intermediate)
- Arrange these broad security activities in a sensible cycle, beginning with identifying what needs protection.(intermediate)
- A security product can replace the continuing work of managing people, technology, and the operating environment.(intermediate)
- Which statement best captures the course review’s view of computer security?(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free