Virtual Labs

a: http.request Explanation

Explanation

b: tcp.flags.syn == 1 and tcp.flags.ack == 0 Explanation

Explanation

c: dns.qry.name == 'example.com' Explanation

Explanation

d: arp.opcode == 2 Explanation

Explanation

a: By filtering for packets where the ARP reply contains an unexpected MAC address. Explanation

Explanation

b: By analyzing DNS query responses. Explanation

Explanation

c: By looking for SYN packets without corresponding ACKs. Explanation

Explanation

d: By filtering for HTTP GET requests. Explanation

Explanation

a: SYN flood attack Explanation

Explanation

b: DNS spoofing Explanation

Explanation

c: Xmas scan Explanation

Explanation

d: Man-in-the-middle attack Explanation

Explanation

Identifying and Investigating Various Network Attacks using Wireshark