You suspect an increase in malicious traffic on your network. You run several packet captures to
analyze traffic patterns and look for signs of intruders. While studying the packets, you are
currently looking for ICMP Messages. You choose to use the IP Protocol ID to locate different
kinds of packets. What is the IP Protocol ID of ICMP?

You have used a diagnostic utility to run a trace between two nodes on your network. During the
trace, you are running a packet capture utility and notice the TTL is reaching zero on the trace.
What will the router that identified the TTL as zero return to the host that originated the trace
command?

Recently you feel your network has been attacked by people sending out of spec packets to your
firewall
in order to get past the firewall rules. You have decided that you will capture all the packets on the
firewall segment with network monitor to analyze the TCP headers for proper use. If you capture a
packet that is the first part of a legitimate three way handshake between two Windows 2000
professional computers, what will the SEQ and ACK values be for the initializing packet?

During a network packet capture in Wireshark, you capture ICMP traffic, and are analyzing this
capture.
In an ICMP Message, what is the function of the first eight bits?

You are introducing a co-worker to the security systems in place in your organization. During the
discussion you begin talking about the network, and how it is implemented. You decide to run a
packet capture to identify different aspects of network traffic for your co-worker. In the packet
capture you are able to identify Protocol IDs. What is the IP protocol ID for TCP?

The three-way handshake utilizes three steps, identified as: Step 1, 2 and 3, that take place
between a client and a server in order to establish a TCP connection.

In Step 2 of a normal three-way handshake, the server is said to be performing:

A significant function of TCP is the ability to guarantee session information. The method used by
TCP to guarantee the uniqueness of a session between two hosts is which of the following?

You are capturing network traffic in Wireshark, for in-depth analysis. When looking at a TCP
Header, what is the function of the first sixteen bits?

Your office branch has been assigned the network address of 10.10.0.0/16 by the Corporate HQ.
Presently your network addressing scheme has these addresses split into eight networks as
shown below:

1: 10.10.0.0/19
2: 10.10.32.0/19
3: 10.10.64.0/19
4: 10.10.96.0/19
5: 10.10.128.0/19
6: 10.10.160.0/19
7: 10.10.192.0/19
8: 10.10.224.0/19
You need to take the currently unused block of network 10.10.160.0/19 and further divide it into
eight networks for use by a satellite branch that is being designed on the fourth floor of your
building. What will the new subnet mask be for these new networks?

During a network capture in Network Monitor, you capture some UDP traffic. In a UDP Header,
what is the function of the first sixteen bits?