Discuss HP HPE7-A02 Exam Topic 1 Question 6

Refer to the exhibit.

The exhibit shows a saved packet capture, which you have opened in Wireshark. You want to focus on the complete conversation between 10.1.70.90 and 10.1.79.11 that uses source port 5448.

What is a simple way to do this in Wireshark?

AApply a capture filter that selects for both the 10.1.70.90 and 10.1.79.11 IP addresses.

BClick the Source column and then the Destination column to sort the packets into the desired order.

CApply a capture filter that selects for TCP port 5448.

DRight-click one of the packets between those addresses and choose to follow the stream.

Suggested Answer: D

Wireshark: Follow TCP Stream:

Wireshark provides an intuitive feature to filter and display a complete TCP conversation.

By right-clicking any packet within the conversation and selecting 'Follow TCP Stream', Wireshark isolates and displays the entire conversation.

This feature allows you to view the communication in a simplified, sequential manner, including requests and responses.

Option Analysis:

Option A: Incorrect. Capture filters only apply during packet capturing, not for analyzing already saved packet captures.

Option B: Incorrect. Sorting packets helps with organizing data but does not isolate a complete conversation.

Option C: Incorrect. A capture filter for TCP port 5448 would have to be applied before capturing; it does not work for saved data.

Option D: Correct. Right-clicking a packet and choosing 'Follow TCP Stream' is the simplest way to display the full conversation between 10.1.70.90 and 10.1.79.11 on port 5448.

Steps in Wireshark to Follow a TCP Stream:

Locate any packet within the desired conversation (e.g., between 10.1.70.90 and 10.1.79.11 on TCP port 5448).

Right-click on the packet.

Choose 'Follow' 'TCP Stream'.

Wireshark will display the entire TCP conversation, including both directions of communication.

This feature is especially useful when troubleshooting or analyzing detailed interactions between hosts.

Get Premium HPE7-A02 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

33 comments · newest first

Tommy 11 months ago

Sorting by source and destination won't give you the full convo.

Sharen 11 months ago

Wait, can you really just right-click? Seems too simple.

Lucille 11 months ago

Definitely go with option D, it’s the quickest way!

Johnson 12 months ago

I think applying a filter for both IPs is better.

Kerry 12 months ago

Just use the "Follow Stream" option, super easy!

Belen 12 months ago

I definitely think right-clicking to follow the stream is the best choice; it seems like the most straightforward method!

Hollis 1 year ago

Applying a filter for TCP port 5448 sounds familiar, but I feel like we might miss some packets that way.

Rolande 1 year ago

I remember practicing a question where we had to filter by IP addresses, but I can't recall if that's what we should do here.

Emogene 1 year ago

I think we need to follow the stream option, but I'm not entirely sure if that's the simplest way.

Launa 1 year ago

I'm confident I can solve this. The question is clearly asking for a capture filter to select the specific IP addresses and port. I'll go with option A.

Amalia 1 year ago

Okay, I think I've got this. The question is asking for a simple way to focus on the conversation between the two IP addresses using the specified source port. I'll go with option D and try to follow the stream.

Tess 1 year ago

Hmm, I'm a bit unsure about this one. There are a few different options, and I want to make sure I understand the question correctly before answering.

Glennis 1 year ago

This looks like a straightforward Wireshark question. I think the key is to focus on the specific details provided, like the IP addresses and source port.

Blythe 2 years ago

Ah, Wireshark, the tool that turns network analysis into a game of 'Where's Waldo?' Option D is the clear choice for the lazy and efficient among us.

Beckie 2 years ago

↳ replying to Blythe

Jade: Let's go with option D then.

Karl 2 years ago

↳ replying to Blythe

User 3: Definitely, it saves time and effort.

Jade 2 years ago

↳ replying to Blythe

User 2: Agreed, following the stream is the easiest.

Toi 2 years ago

↳ replying to Blythe

User 1: I think option D is the way to go.

Ashley 2 years ago

Option D is the winner here. It's like a magic trick - one click and poof, all the relevant packets appear! I bet the exam writers are just trying to distract us with those other options.

Marjory 2 years ago

↳ replying to Ashley

Yeah, it saves so much time compared to the other options. It's a lifesaver!

Jacquelyne 2 years ago

↳ replying to Ashley

I agree, option D is definitely the easiest way to focus on the complete conversation.

Corazon 2 years ago

D is the way to go. Who needs complicated filters when you can just right-click and boom, there's your conversation! *mic drop*

Alaine 2 years ago

I think option C would work too, but D is definitely the simplest approach. Gotta love those Wireshark shortcuts!

Leota 2 years ago

↳ replying to Alaine

Yeah, I always go for the follow stream option when I need to analyze a specific conversation.

Franklyn 2 years ago

↳ replying to Alaine

I agree, option D is the easiest way to focus on that specific conversation.

Tawanna 2 years ago

The correct answer is D. Right-clicking the packet and choosing to follow the stream is the easiest way to focus on the complete conversation between the two IP addresses using the specified source port.

Jacquelyne 2 years ago

↳ replying to Tawanna

User4: Thanks for the clarification, I'll remember that for next time.

Emile 2 years ago

↳ replying to Tawanna

User3: I agree with User2, following the stream is the way to go.

Rachael 2 years ago

↳ replying to Tawanna

User2: No, I believe the correct answer is D) Right-click a packet and follow the stream.

Mee 2 years ago

↳ replying to Tawanna

User1: I think the answer is A) Apply a capture filter for both IP addresses.

Cassi 2 years ago

But following the stream will show us the complete conversation, which is what the question asks for.

Delsie 2 years ago

I disagree, I believe the correct answer is A, applying a capture filter for both IP addresses.

Cassi 2 years ago

I think the answer is D, we need to follow the stream between those addresses.

HPE7-A02 Exam - Topic 1 Question 6 Discussion