Cybersecurity Incident and Network Basics

A unique identifier assigned to a device on a network.

A unique identifier assigned to a network interface card (NIC) on a device.

An IP address that allows communication with all devices on a local network.

An IP address that allows communication with specific devices on a network.

A range of IP addresses reserved for private networks, not accessible from the internet.

An IP address that is globally unique and accessible from the internet.

The data exchanged between devices on a network.

A set of rules that govern how data is transmitted and received over a network.

A unique identifier assigned to a network interface card (NIC) on a device. It's permanent and burned into the hardware.

The first three groups of a MAC address, identifying the manufacturer of the network device.

A special MAC address (FF-FF-FF-FF-FF-FF) used to send a message to all devices on the network.

A MAC address that starts with a special prefix, used to send messages to a group of devices.

A number between 1 and 65,535 that identifies a specific running application listening for network packets.

A unique identifier assigned to a device on a network. It allows devices to communicate with each other.

An IP address that is globally unique and accessible from the internet.

A range of IP addresses reserved for private networks, not accessible from the internet.

A pane showing all the captured frames from a network capture, sorted by default by time.

A pane showing the structure of each captured packet, broken down by its different protocol layers.

A pane displaying the raw data of the selected frame in both hexadecimal and textual formats.

A method of filtering packets within Wireshark by specific criteria, allowing the user to focus on relevant data.

A filter type in Wireshark that allows you to select packets based on their source IP address, such as 'ip.src == 10.0.0.1'.

A filter type in Wireshark that allows you to select packets based on their destination IP address, such as 'ip.dst == 192.168.1.3'.

A filter type in Wireshark that allows you to select packets based on a specific protocol.

Logical operators used in Wireshark filters, such as 'and', 'or', and 'not', to combine multiple filter criteria.

A uniform resource identifier (URI) identifies a resource. URIs are generic and may be used for various purposes, like pointing to files.

The HTTP URI consists of 5 main parts: scheme, host, port, path, and query.

The protocol used, either http or https.

The host running the webserver.

Port of the webserver. If not specified, the default port for the protocol is used (80 for http, 443 for https).

Path to the resource on the server.

Appears at the end of the path after the question mark. This is optional and allows passing parameters to the webserver. Parameters are given key-value pairs and are separated using the and (&) sign.

GET and POST are the most common methods that are implemented by all servers and are utilized by your web browser directly.

A header sent by a client to a server, providing information about the client's browser, operating system, and other details.

The server can provide different content (or style) for different clients based on their User Agent header. This allows for things like mobile-friendly versions of websites.

The 'User Agent' header can contain information like:

• The browser (e.g., Chrome, Firefox)
• The operating system (e.g., Windows, macOS)
• The browser engine version (e.g., AppleWebKit 525.13)

A set of rules that govern how data is transmitted and received over a network. HTTP is a common example.

A series of codes indicating whether a request was completed successfully, the type and size of the response content, and whether the requested resource was found. For example, 200 (OK) means everything went well and 404 (Not Found) means the page doesn't exist.

In an HTTP request, the 'User-Agent' header is sent by the client (e.g., your web browser) to the server. This header provides information about the client's browser, operating system, and other details.

The 'User-Agent' header allows the server to send content that is tailored to the specific client. This is useful for providing mobile-friendly versions of websites or for different browsers.

The 'User-Agent' header is just one example of a header that can be used in an HTTP request. There are many other headers that provide additional information about the client or the request itself.

A system that translates domain names (like google.com) into IP addresses (like 72.17.11.228) for computers to understand.

A request sent from your computer to a DNS server, asking for the IP address of a specific domain name.

The response from a DNS server containing the IP address of the requested domain.

A client-server system where your computer (the client) asks a DNS server for an IP address.

A tool like Wireshark can be used to analyze network traffic, including DNS queries, to see which websites someone has visited, even when HTTPS is used.

Content-Encoding specifies the compression method used for a resource. It helps reduce the amount of data transferred across the network.

A protocol that's used to establish a secure connection between a client and a server, ensuring data privacy and integrity.

A program that captures and analyzes network traffic. It helps understand what's happening on a network.