Advanced Wireshark Traffic Analysis | Complete Guide | TryHackMe

[@albuandrei2005]

thanks for your help man, had to go through it at least twice get a good understanding of it. With just the help from THM I couldn't have done it.

[@mohamedmohamed-yt3bi]

for question 1 in task 4, i used this query to look up the Galaxy A30, frame matches GALAXY, then i got 3 hits, the 3rd one that is of the IP 172.16.13.49 is the one meant to be for Galaxy A30, if you look up the host name field, you find you will find it in there.

[@wabisabi84]

For the question that reads, "Investigate the anomalous packets. Which protocol is used in ICMP tunnelling?" Is there another way to find the answer?

[@balys07]

For me it is not clear how the answer is 170. What is the packet number where "empty password" was submitted?

[@y-gy7bc]

I was able to get the host mac address of task 4 Q1 by going through the dhcp requests using the filter: dhcp.option.dhcp == 3 checked the 172.16.13.49 and then jackpot found haha