Question

In the lab, you used the filter box in Wireshark to remove traffic from port 3389. What is that port used for? What filter syntax could you use to show only the Ping traffic that was generated in the lab?

Answer 1

Port 3389 is used for remote desktop access to graphical interfaces.

The syntax used to track ping traffic is " tcp.port eq 25 or icmp".

Step-by-step explanation:

Wireshark is a network packet sniffer tool used to analysing and troubleshooting packet transmission in a network.

The ping command is used in a network to check or confirm connectivity between two devices in the network. It sends ICMP message echos to the specified IP address and receives it back if there is connection. To get the ping traffic in wireshark the command syntax " tcp.port eq 25 or icmp" is used.

The port 3389 is a TCP and UDP listening port for the Microsoft proprietary protocol called remote desktop protocol or connection used to remotely connect to the graphical interface of other system running the RDP server.