Wireshark Pcap Analysis Assignment | Get Paper Help

A case study, Your task It is expected that this part will be in the region of 1000 words (+/- 10%). To keep your word count low, you are advised to use diagrams, screen captures etc. The third stage of the interview process is to test your practical skills. You will be given a Wireshark output file containing data of network activities, which will be made available on Blackboard in the Assessment section. Please download it. You will have to analyse that file and produce a report on your findings. The tool that you will be using to examine the file is the Wireshark network protocol analyser which is a free tool and available from https://www.wireshark.org

A case study

Your task:

It is expected that this report will be in the region of 1000 words (+/- 10%). To keep your wordcount low, you are advised to use diagrams, screen captures etc.

You will be given a Wireshark pcap output file containing data of network packet transfer activities.  You will have to analyse that file and produce a report on your findings. The tool that you will be using to examine the file is the Wireshark network protocol analyser which is a free tool and available from https://www.wireshark.org/.

Detailed requirements:

You are expected to:

• Provide a methodology explaining what steps you have taken to analyse the Wireshark file. This could be presented as a table or flowchart showing various aspects e.g. syntax for filters, expected results etc.
• Analyse the Wireshark file. This is probably one of the hardest activities and you are urged to allocate appropriate time for doing it. When analysing the Wireshark output file, you should provide screen captures as evidences. You are asked to identify the following items: o Network boundaries: network boundaries are where a packet crosses from one network to another. Wireshark’s statistics menu can be used to show all endpoints (nodes).

• Types of traffic: this process aims to examine the traffic in and out of the network and to identify which traffic is normal and which traffic is suspicious.

• Any specific activities: to collate together all the evidences found from the Wireshark output file and deduce what kind of malicious activities e.g. network scanning, DoS or access attack etc. are being performed on the network.

Marking scheme