200-201 · Question #207
Refer to the exhibit. Which frame numbers contain a file that is extractable via TCP stream within Wireshark?
The correct answer is C. 14,16,18, and 19. Frames containing actual data transfer payload within a TCP stream are extractable as a file in Wireshark, typically indicated by specific protocols like HTTP or FTP data segments.
Question
Refer to the exhibit. Which frame numbers contain a file that is extractable via TCP stream within Wireshark?
Exhibit
Options
- A7,14, and 21
- B7 and 21
- C14,16,18, and 19
- D7 to 21
How the community answered
(31 responses)- A13% (4)
- B6% (2)
- C55% (17)
- D26% (8)
Why each option
Frames containing actual data transfer payload within a TCP stream are extractable as a file in Wireshark, typically indicated by specific protocols like HTTP or FTP data segments.
Frames 7 and 21 are more likely to represent connection establishment or control messages, rather than the primary data segments needed for file extraction.
Frames 7 and 21 typically signify the initiation or termination of a TCP session and would not contain the bulk of the file data.
Frames 14, 16, 18, and 19 (assuming these frames carry the actual data segments of a file transfer over TCP, such as HTTP body or FTP DATA channel content) would contain the raw bytes that Wireshark can reassemble into an extractable file.
Specifying a range from 7 to 21 is too broad and would include many non-data frames or control messages that are not directly part of an extractable file's content.
Concept tested: Wireshark TCP stream reassembly/file extraction
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChIOFollowTCPStream.html
Topics
Community Discussion
No community discussion yet for this question.