Packet Analysis Quiz

  1. Which OSI layer does a Router primarily operate at when making forwarding decisions?

    1. Layer 2 (Data Link)

    2. Layer 3 (Network)

    3. Layer 4 (Transport)

    4. Layer 7 (Application)

  2. In a TCP three-way handshake, what is the correct sequence of flags sent?

    1. SYN, SYN-ACK, ACK

    2. SYN, ACK, SYN-ACK

    3. PSH, ACK, FIN

    4. RST, SYN, ACK

  3. What does a “Time to Live” (TTL) value of 0 in an IPv4 header signify?

    1. The packet should be prioritized.

    2. The packet has reached its destination.

    3. The packet should be fragmented.

    4. The packet must be discarded and an ICMP Time Exceeded message sent.

  4. Which protocol uses a 4-step termination process (FIN, ACK, FIN, ACK)?

    1. UDP

    2. ICMP

    3. TCP

    4. ARP

  5. When analyzing a packet capture, you see an ARP Request. What is the destination MAC?

    1. 00:00:00:00:00:00

    2. FF:FF:FF:FF:FF:FF

    3. The MAC address of the default gateway.

    4. 127.0.0.1

  6. Which field in the UDP header provides a way to verify data integrity?

    1. Sequence Number

    2. Window Size

    3. Acknowledgement Number

    4. Checksum

  7. A TCP “Reset” (RST) flag typically indicates what?

    1. The connection is being closed gracefully.

    2. The receiver is ready for more data.

    3. An immediate abortion of the connection.

    4. The start of a new session.

  8. Which port number is commonly associated with encrypted HTTPS traffic?

    1. 80

    2. 21

    3. 53

    4. 443

  9. In Wireshark, what filter shows traffic for a specific IP regardless of direction?

    1. ip.addr == 192.168.1.5

    2. tcp.port == 192.168.1.5

    3. eth.dst == 192.168.1.5

    4. ip.src != 192.168.1.5

  10. What is the primary difference between a Hub and a Switch?

    1. Hubs use IP addresses; Switches use MAC addresses.

    2. Hubs broadcast all traffic; Switches forward to specific ports.

    3. Switches are slower than hubs.

    4. Hubs operate at the Application layer.

Answer key with explanations

1. Layer 3 Answer: B Routers utilize IP addresses (Layer 3) to determine the logical path through a network.

2. TCP Handshake Answer: A The SYN (Synchronize) starts the request, SYN-ACK acknowledges it and requests synchronization back, and the final ACK (Acknowledge) confirms the setup.

3. Time to Live Answer: D TTL prevents infinite loops. If it hits 0, the router drops the packet and notifies the sender via ICMP.

4. Termination Answer: C TCP ensures both sides have finished sending data. Each side must independently send a FIN and receive an ACK.

5. ARP Addressing Answer: B Because the sender doesn’t know the destination MAC, it uses the broadcast address (FF:FF:FF:FF:FF:FF) so all devices on the segment hear the request.

6. UDP Integrity Answer: D The Checksum is the only field in the UDP header used to verify that the bits haven’t been flipped during transit.

7. The RST Flag Answer: C An RST (Reset) is an ungraceful termination. It is sent when a host receives a packet for a connection it doesn’t recognize or to reject a connection.

8. Common Ports Answer: D Port 443 is the standard for Secure HTTP (HTTPS), while Port 80 is for standard HTTP.

9. Wireshark Syntax Answer: A The ip.addr display filter is a shorthand that matches the specified IP in either the source or destination fields.

10. Hubs vs. Switches Answer: B Hubs repeat data to every port (Collision Domain), while Switches maintain a MAC address table to forward data only to the relevant recipient.