A municipal capture file is huge. What analysis approach best focuses work on one target BSS?
Select an answer to reveal the explanation.
Short Explanation
Giant PCAPs need filters, not coin-flip deletions. Lock analysis to the target BSSID and the EAP/handshake frames that matter.
Full Explanation
Huge municipal capture files are managed by filtering: apply Wireshark or tshark display/capture filters to the target BSSID and to relevant EAP or handshake frames so analysis focuses on one BSS. That approach preserves evidentiary integrity while making investigation tractable. City assessors should slice by identifier and frame class rather than destroying data randomly. Deleting half the packets at random so Wireshark opens faster fails by concept: random deletion can destroy handshake completeness and evidence integrity. Converting the PCAP to a spreadsheet of RSSI averages and discarding frame types fails by concept: averages without frame semantics lose EAPOL/handshake value. Opening only in a text editor searching for ASCII 'password=' fails by concept: Wi-Fi secrets are not stored that way in captures, and text editors are poor protocol analyzers. Exam caveat: filter for analysis copies when needed, but retain the original full capture hash-verified in evidence storage for civic chain-of-custody. Operational check: duplicate the master pcap, filter with wlan.bssid == <target> and eapol filters as appropriate, confirm 4-way messages if pursuing Personal offline analysis, and document filter strings used in the report.