210-255 · Question #31
Refer to the exhibit. Which packet contains a file that is extractable within Wireshark?
The correct answer is C. 2542. Wireshark's Export Objects feature can reassemble and extract files from captured protocol streams such as HTTP, SMB, or FTP.
Question
Refer to the exhibit. Which packet contains a file that is extractable within Wireshark?
Exhibit
Options
- A1986
- B2318
- C2542
- D2317
How the community answered
(27 responses)- A15% (4)
- B4% (1)
- C70% (19)
- D11% (3)
Why each option
Wireshark's Export Objects feature can reassemble and extract files from captured protocol streams such as HTTP, SMB, or FTP.
Packet 1986 does not belong to a protocol stream containing a complete, reassemblable file object that Wireshark's Export Objects function can extract.
Packet 2318 does not represent a file transfer in a protocol stream that Wireshark can use for object extraction.
Packet 2542 is part of a protocol stream (such as HTTP or SMB) carrying a complete, reassemblable file object, allowing Wireshark's 'Export Objects' feature (File - Export Objects) to reconstruct and save the transferred file from the capture - a capability tied to application-layer protocol reassembly.
Packet 2317 does not contain an exportable file object within a supported application-layer protocol stream.
Concept tested: File extraction from packet captures using Wireshark Export Objects
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChIOExportSection.html
Topics
Community Discussion
No community discussion yet for this question.