GIAC
GCED · Question #87
An internal host at IP address 10.10.50.100 is suspected to be communicating with a command and control whenever a user launches browser window. What features and settings of Wireshark should be…
The correct answer is C. Filter traffic using ip.src = = 10.10.50.100 and tcp.dstport = = 80, and use Follow TCP stream. You've hit your limit · resets 1pm (America/New_York)
Perimeter Security and Intrusion Detection
Question
An internal host at IP address 10.10.50.100 is suspected to be communicating with a command and control whenever a user launches browser window. What features and settings of Wireshark should be used to isolate and analyze this network traffic?
Options
- AFilter traffic using ip.src = = 10.10.50.100 and tcp.srcport = = 80, and use Expert Info
- BFilter traffic using ip.src = = 10.10.50.100 and tcp.dstport = = 53, and use Expert Info
- CFilter traffic using ip.src = = 10.10.50.100 and tcp.dstport = = 80, and use Follow TCP stream
- DFilter traffic using ip.src = = 10.10.50.100, and use Follow TCP stream
How the community answered
(34 responses)- A15% (5)
- B3% (1)
- C74% (25)
- D9% (3)
Explanation
You've hit your limit · resets 1pm (America/New_York)
Topics
#Wireshark#packet filtering#C2 communication#traffic analysis
Community Discussion
No community discussion yet for this question.