Analyzing Tshark Filters for HTTP and UDP Traffic
Short answer
B The command displays unencrypted web requests and DNS traffic because HTTP is plaintext and standard DNS over UDP is also unencrypted.
Question
$tshark -r file.pcap -Y "http or udp"
Which of the following will the command line display?
Key Takeaways
The main trap is confusing HTTP with HTTPS; HTTP is inherently unencrypted, while HTTPS is encrypted and requires different handling or keys to be parsed as such.
This page explains why the tshark command with 'http or udp' filters reveals only unencrypted web and DNS traffic, distinguishing them from encrypted alternatives.
Common mistake: Choosing D (Both encrypted and unencrypted) is incorrect because standard HTTPS traffic is encrypted and does not match the 'http' filter unless decryption keys are provided.
Expert Analysis
The command tshark -r file.pcap -Y "http or udp" utilizes Wireshark's display filter language to select packets for display. The key to answering this question lies in understanding how protocols are identified and decrypted at different layers of the OSI model.
HTTP Protocol Identification
The filter -Y "http" selects packets that contain HTTP data. By definition, standard HTTP operates over port 80 (or sometimes 8080) and is transmitted in plaintext. Therefore, any traffic matching the "http" dissector is unencrypted web traffic. If the traffic were HTTPS (port 443), it would be encrypted and handled by the TLS dissector, not the HTTP dissector, unless specific decryption keys are loaded into Wireshark/tshark. Since no keys are mentioned, HTTPS traffic is excluded from the "http" filter match.
UDP and DNS Traffic
The filter -Y "udp" selects all User Datagram Protocol packets. Domain Name System (DNS) queries and responses typically use UDP on port 53. While DNS can use TCP, the vast majority of standard lookups are UDP. Consequently, filtering for "udp" will capture these DNS transactions. Like HTTP, standard DNS traffic is sent in clear text without encryption.
Encryption Status Neither standard HTTP nor standard DNS involves encryption by default. Encrypted web requests (HTTPS) require TLS/SSL, which tshark cannot parse as "http" without explicit configuration. Similarly, encrypted DNS (DoH or DoT) uses TCP or UDP but encapsulates the payload in a way that prevents simple protocol identification without specific handling. Since the scenario describes a basic analyst using a standard command line tool without mentioning decryption keys, the output consists solely of plaintext protocols.
Therefore, the command displays unencrypted web requests (HTTP) and DNS traffic (via UDP). It does not display encrypted traffic because those packets do not match the "http" or plain "udp" (in the context of identifiable DNS payloads) filters in their encrypted form.
Exam Strategy
When analyzing packet capture tools, always consider the layer of encryption. Filters like 'http' target specific application-layer protocols in plaintext. Encrypted variants (like HTTPS) operate at higher layers or use different port numbers and protocol identifiers. Always check if the scenario provides decryption keys; if not, assume encrypted traffic is opaque to simple protocol filters.
Frequently Asked Questions
Does tshark decrypt HTTPS traffic automatically?
Why is DNS included if the filter is 'udp'?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
iamoma 👍 1 Answered BThe command uses a Wireshark display filter: - -r file.pcap — Reads packets from the capture file file.pcap. - -Y "http or udp" — Displays packets matching either the HTTP protocol or the UDP protocol.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.