A hospital analyst holds a packet capture of a cleartext HTTP file download from a clinical workstation. What is the practical way to extract that file from the capture?
Select an answer to reveal the explanation.
Short Explanation
Putting a torn letter back together means aligning the scraps, not measuring the envelope. You reassemble the TCP session and export the HTTP object. The trap is reading a window size, an ARP entry, or a flow counter as if it were the file.
Full Explanation
The right selection is "Reassemble the TCP session and export the HTTP object that the clear download carried". The download is clear HTTP, so the bytes of the object sit in the TCP payload of that session. Reassembly puts those segments back in order, and exporting the HTTP object lifts the file out of the stream. The statement "Read only the TCP window size on the download packets and treat that flow-control number as the file" is only the receiver's flow-control window, a number of bytes it is willing to accept, and it is not the file. The statement "Look up the workstation in the ARP cache and copy the mapped hardware address out as the file body" maps an IP address to a hardware address and holds no application bytes. The statement "Sample the flow counters and try to rebuild the file from byte totals and the ports alone" keeps totals and ports, and a sample of counters has already discarded the payload you would need to rebuild the object. Exam caveat: follow the TCP stream and export the HTTP object on this clear capture; the same reassembly on a TLS session yields ciphertext, not the file. Operational check: reassemble the download session, export the HTTP object, and compare its size with the length the HTTP response declared.