200-201 · Question #334
Refer to the exhibit. Which frame numbers contain a file that is extractable from Wireshark PCAP?
The correct answer is D. All Frames from No. 20061 to 20064. A file extractable from a Wireshark PCAP typically spans multiple consecutive frames that collectively constitute the complete data transfer of that file via protocols like HTTP or FTP.
Question
Refer to the exhibit. Which frame numbers contain a file that is extractable from Wireshark PCAP?
Exhibit
Options
- AFrames No. 20064 and 20066
- BFrame No. 20064
- CFrame No. 20086
- DAll Frames from No. 20061 to 20064
How the community answered
(54 responses)- A6% (3)
- B4% (2)
- C17% (9)
- D74% (40)
Why each option
A file extractable from a Wireshark PCAP typically spans multiple consecutive frames that collectively constitute the complete data transfer of that file via protocols like HTTP or FTP.
It is unlikely a file extraction would occur from only two potentially non-consecutive frames, especially if other frames are part of the same data stream.
A single frame is highly unlikely to contain an entire extractable file, as most files are larger than what a single network packet can hold.
Frame No. 20086, if not part of the contiguous data transfer identified by Wireshark's file extraction logic, would not individually or in combination with other frames from a different stream constitute the same extractable file.
Files transferred over protocols like HTTP or FTP are often broken down into multiple packets and transmitted across several frames in a PCAP. For Wireshark to successfully extract a complete file, all the frames that contain segments of that file's data stream, such as those from 20061 to 20064, must be included.
Concept tested: Wireshark file extraction from PCAP
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChProtExportObjects.html
Topics
Community Discussion
No community discussion yet for this question.
