Chapter 6: Network Security Data Analysis

1. (1) and (4)
   A PCAP file can be opened in Wireshark using the File | Open menu option. Wireshark can read in an ASCII hex dump and write the data described into a temporary libpcap capture file for display and analysis. This is useful for packet capture technologies that are unable to output in another of Wireshark's accepted file formats.
   The libpcap filetype is a menu option for saving Wireshark captures, but in opening files, Wireshark will attempt to interpret files internally, so it isn't necessary to specify the libpcap format.
   Dragging and dropping the PCAP file into Wireshark will also open up a PCAP file.
2. (1)
   The port number is a 2-byte field, and therefore is 4 hexadecimal characters in length. 0080 is the hexadecimal representation of the number 128. 0050 is the port value in Hex for HTTP. The packet bytes pane also...