Reference no: EM133255363

Screenshots included for context.

1. What is the nature of communications occurring between the source and destination endpoints (or IP addresses). What differentiates the DNS query from the TCP ACK segment?
2. What can be inferred from the statistical information in the Destination and Ports window as far as a wireless threat is concerned?
3. What is your point of view on the Rate and Percent columns of the Statistics output with respect to the Count column? Does this information indicate any possibility of a compromise? If so, why?
4. What useful information can be determined from the flow graph based on analysis w.r.t. any IOC of the wireless/mobile communications?
5. Is there any indication of any wireless vulnerabilities such as the use of default SSIDs and passwords and the use of vulnerable WEP protocol upon analyzing the WLAN traffic? Why or why not?
6. How is this indication different from the Statistics information retrieved earlier and from the perspective of this attack? Is there any Wireshark feature that can help you arrive at the same conclusion?
7. What legitimate or illegitimate role does the host/user with the 192.168.1.132 or 192.168.1.1 IP address play in the suspected WLAN traffic?
8. If malicious actors got into the network to access the network security logs, how could they use the packet details to their advantage? Specifically, what utilities within Wireshark can you count on?
9. What are some examples of IP addresses, hostnames, and mac addresses based on an analysis of the PCAP files in Wireshark. What do you think is happening so far in your view?
10. From the perspective of access control and firewall rules, what are the components of an ACL and where can rules be placed on the network?
11. How do you implement ACL firewall rules on a firewall, router, or relevant network appliance?
12. Will using any filter in the Apply a display filter box such as tcp, http, or icmp before retrieving the firewall rules has any impact? Why or why not?