Discuss GIAC GCED Exam Topic 1 Question 78

What feature of Wireshark allows the analysis of one HTTP conversation?

AFollow UDP Stream

BFollow TCP Stream

CConversation list > IPV4

DSetting a display filter to 'tcp'

Suggested Answer: B

Follow TCP Stream is a feature of Wireshark that allows the analysis of a single TCP conversation between two hosts over multiple packets. Filtering packets using tcp in the filter box will return all TCP packets, not grouping by a single TCP conversation. HTTP is TCP not UDP, so you cannot follow a HTTP stream over UDP.

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

22 comments · newest first

Jacinta 2 days ago

Yeah, that makes sense. It shows the whole conversation.

Graham 7 days ago

I think it's B) Follow TCP Stream.

Coletta 12 days ago

B) is definitely the best choice. It captures everything in order!

Gianna 17 days ago

D) Display filter to 'tcp' helps, but doesn't show the whole flow.

Corinne 22 days ago

C) Conversation list > IPV4 is too broad. We need specifics.

Gianna 28 days ago

I feel like A) Follow UDP Stream is misleading. UDP isn't used for HTTP.

Janae 1 month ago

Agreed! TCP is essential for HTTP.

Zachary 1 month ago

I think it's B) Follow TCP Stream. It shows the whole conversation.

Dona 1 month ago

I always use C) Conversation list > IPV4 for quick checks!

Jennie 2 months ago

Wait, is it really B? I thought it could be D too.

Howard 2 months ago

B is correct! It shows the whole conversation.

Hollis 2 months ago

I thought it was A) Follow UDP Stream, but I guess not.

Alexia 2 months ago

Definitely B) Follow TCP Stream. That's the one!

Pamela 2 months ago

I agree, B is the way to go!

Eliseo 2 months ago

Wait, is it really just B? I thought it could be more complex.

Tamala 3 months ago

B is correct, but why would anyone use UDP for HTTP?

Carmela 3 months ago

I thought it was A) Follow UDP Stream at first.

Shannan 3 months ago

Definitely B) Follow TCP Stream. That's the one!

Niesha 3 months ago

I thought it might be A) Follow UDP Stream, but that doesn't seem right for HTTP. I guess it's B) after all.

Giuseppe 3 months ago

I practiced a similar question, and I feel like the answer is definitely B) Follow TCP Stream.

Francesco 4 months ago

I'm not entirely sure, but I remember something about using a conversation list. Maybe it's C)?

Major 5 months ago

I think it's B) Follow TCP Stream because HTTP typically runs over TCP, right?

GIAC GCED Exam - Topic 1 Question 78 Discussion