# Networking: Wireshark: The Basics (TryHackMe)

In this article, I will write a write-up for Wireshark: The Basic that covers how Tool Overview, Packet Dissection, Packet Navigation, and Packet Filtering.

1. Which file is used to **simulate** the screenshots? `http1.pcapng`
    
2. Which file is used to **answer** the questions? `Exercise.pcapng`
    
    **Use the "Exercise.pcapng" file to answer the questions.**
    
3. Read the **"capture file comments"**. What is the flag? `TryHackMe_Wireshark_Demo`
    
    Once you’ve opened the Exercise.pcapng file check the Statistics > Capture File Properties (it will answer the next questions)
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729883259819/bf459c1c-d6c4-4d6a-ab74-a18666bae86c.png align="center")
    
4. What is the total number of packets? `58620`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729883388723/08f23c21-4d52-464b-931b-6a389d1dd397.png align="center")
    
5. What is the **SHA256 hash** value of the capture file? `f446de335565fb0b0ee5e5a3266703c778b2f3dfad7efeaeccb2da5641a6d6eb`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729883422084/23858b7c-59d1-4e31-bba3-7a2639a87e04.png align="center")
    
    **Use the "Exercise.pcapng" file to answer the questions.**
    
6. **View packet number 38.** Which markup language is used under the HTTP protocol? `eXtensible Markup Language`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729883458566/70099fc2-54ab-4ba0-b291-d857ae9e13dd.png align="center")
    
7. What is the arrival date of the packet? (Answer format: Month/Day/Year) `05/13/2004`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729883523645/3da428e4-7913-4683-8203-6ab047a1a47b.png align="center")
    
8. What is the TTL value? `47`
    
9. What is the TCP payload size? `424`
    
10. What is the e-tag value? `9a01a-4696-7e354b00`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729883632407/fbfb39aa-3719-4c86-b675-8f41d7d5f354.png align="center")
    
    **Use the "Exercise.pcapng" file to answer the questions.**
    
11. Search the **"r4w" string** in packet details. What is the name of artist 1? `r4w8173`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729883736206/6818d49a-abb2-4b03-892d-ce241cda64be.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729883790233/5ee77504-36f0-43d5-a668-e3395c0ce599.png align="center")
    
    Search packet number 39765 as shown above, then once you have it, highlight it and pick File > Export Packet Bytes then it will be saved into the Desktop folder. Once it’s saved you’ll need to get the hash by using the `md5sum` command.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729883813149/b4998072-b074-4788-b7f0-66ea794e8baa.png align="center")
    
12. **Go to packet 12** and read the comments. What is the answer? `911cd574a42865a956ccde2d04495ebf`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729883918089/f76f0083-bdc8-43f5-a670-b9365455b901.png align="center")
    
13. There is a **".txt"** file inside the capture file. Find the file and read it; what is the alien's name? `PACKETMASTER`  
    search the packet with `.txt` file as on the image above, packet 4267 will come up, then right-click the JPEG File Interchange Format then select export objects and select HTTP. When you check Desktop folder on the terminal it will have a lot of files but target `cat nano.txt`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729885163808/c008dfaf-515c-4b51-8c06-c48082dae8d4.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729885195238/d8716f6f-7a85-4bc1-bf1a-e4c4697f3810.png align="center")
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729885220999/3c7c3a85-a175-4786-821b-5beb2d1217b2.png align="center")
    
14. Look at the expert info section. What is the number of warnings? `1636`  
    Go to the Analyze menu item and select Expert Information this will come and you’ll be able to see the number of Warnings
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729885257629/38f5cabf-76fa-4626-8c24-271b2629871e.png align="center")
    
    **Use the "Exercise.pcapng" file to answer the questions.**
    
15. **Go to packet number 4.** Right-click on the "Hypertext Transfer Protocol" and apply it as a filter. Now, look at the filter pane. What is the filter query? `http`
    
16. What is the number of displayed packets? `1089`
    
17. **Go to packet number 33790** and follow the stream. What is the total number of artists? `3`
    
    Search packet number 33790 then double-click on it, at the bottom it will open the bottom you’ll highlight the HyperText Transfer protocol hover over the analyze menu item at the top and select follow then select HTTP Stream it will open the window attached to question 18 and looking through we’ve artist=1 to artist=3 with their respective names
    
18. What is the name of the second artist? `Blad3`
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729885297445/157810d9-e3bf-47ce-a0d8-dbb216f1d482.png align="center")
    

Thank you for reading my article. Please leave any questions or comments on improving my learning journey and the THM challenges.