1. Which tool is better at executing protocol gaining controls and which tool is better at executing protocol analysis?

Wireshark is better for executing protocol analysis and Netwitness Investigator is best at executing protocol gaining controls. Wireshark does good at both facets. which makes it a small better.

2. What is promiscuous manners and how does this allow tcpdump. Wireshark. and NetWitness Investigator to execute protocol gaining control off a unrecorded web?

Promiscuous manner is for a wired web interface accountant or radio web interface accountant that causes the accountant to go through all traffic to the CPU alternatively of go throughing merely through the frames the accountant is supposed to have. It allows tcpdump. Wireshark. and NetWitness Investigator to execute protocol gaining control off a unrecorded web because it’s made for package sniffing. which all these applications perform.

3. What is the significance of the TCP tripartite handshaking for applications that utilize TCP as a conveyance protocol? Which application in your protocol gaining control uses TCP as a conveyance protocol?

The significance of the TCP tripartite handshaking is that three messages are transmitted by TCP to negociate and get down a TCP session between the computing machines. The intent is so that two computing machines can negociate the parametric quantities of the web TCP socket connexion before conveying the information. Wireshark is the application that uses TCP as a conveyance protocol.

4. How many different beginning IP host references did you gaining control in your protocol gaining control?

There were 6 different IP host references captured in the protocol gaining control.

5. How many different protocols ( layer 3. bed 4. etc. ) did your protocol gaining control session hold? What map in Wireshark provides you with a dislocation of the different protocol types on the LAN section?

6. Can Wireshark supply you with web traffic package size counts? How and where? Are you able to separate how many of each package size was transmitted on your LAN section? Why is this of import to cognize? 7. Is FTP informations able to be replayed and reconstructed if the packages are captured on the wire? If an onslaught were to happen between the beginning and finish IP host with informations replayed that has been altered. what sort of onslaught is this called? 8. Why is it of import to utilize protocol gaining control tools and protocol analysers as an information systems security professional? 9. What are some challenges to protocol analysis and web traffic analysis? 10. Why would an information systems security practician want to see web traffic on both internal and external LAN sections at the DMZ within the LAN-to-WAN sphere ( i. e. . both on the interior and outside LAN sections ) ?