nerdexam
GIAC

GSEC · Question #340

Use Wireshark to analyze Desktop;PCAP FILES/charile.pcap What is the destination IP address in packet #3?

The correct answer is F. 197.168.184.158. Wireshark displays the destination IP address for each packet in the packet list and detail panes; opening charlie.pcap and selecting packet 3 reveals the destination IP.

Networking and Core Concepts

Question

Use Wireshark to analyze Desktop;PCAP FILES/charile.pcap What is the destination IP address in packet #3?

Exhibit

GSEC question #340 exhibit

Options

  • A192.168.184.2
  • B192.168.184.73
  • C192.168.184.129
  • D192.168.184.111
  • E197.168.184.13
  • F197.168.184.158
  • G192.168.184.201
  • H192.168.184.17
  • I19Z168.184222

How the community answered

(20 responses)
  • A
    10% (2)
  • C
    15% (3)
  • D
    5% (1)
  • F
    70% (14)

Why each option

Wireshark displays the destination IP address for each packet in the packet list and detail panes; opening charlie.pcap and selecting packet 3 reveals the destination IP.

A192.168.184.2

192.168.184.2 is a different address present elsewhere in the capture file, not the destination of the third packet.

B192.168.184.73

192.168.184.73 appears in the PCAP but does not correspond to the destination IP field of packet number 3.

C192.168.184.129

192.168.184.129 is another address in the capture that does not match the destination recorded in packet 3.

D192.168.184.111

192.168.184.111 is present in the capture but is not the destination IP address of packet number 3.

E197.168.184.13

197.168.184.13 is a plausible-looking address in the same subnet range but does not match packet 3's destination field.

F197.168.184.158Correct

Analysis of the charlie.pcap file in Wireshark shows that packet number 3 contains a destination IP address of 197.168.184.158, visible in the Internet Protocol layer of the packet detail pane when that packet is selected.

G192.168.184.201

192.168.184.201 appears in the capture but is not the destination IP of the third packet.

H192.168.184.17

192.168.184.17 is another address in the file but does not correspond to the destination of packet number 3.

I19Z168.184222

19Z168.184222 contains the invalid character 'Z' and is not a syntactically valid IPv4 address.

Concept tested: Wireshark PCAP analysis - identifying packet destination IP

Source: https://www.wireshark.org/docs/wsug_html_chunked/ChWorkDisplayFilterSection.html

Topics

#Wireshark#packet analysis#PCAP#network forensics

Community Discussion

No community discussion yet for this question.

Full GSEC Practice