Question 1: Process the “sample.pcap” file and look at the details of the first DNS log that appear on the dashboard. What is the “qclass_name”?
I’ll begin by loading the pcap into Brim.
Press enter or click to view image in full size
It feels nice looking at a GUI for once.
To select the entire row, I clicked on the far left side of the column so that I don’t click on just one value (although not sure if it matters if you clicked on a value or not).
Press enter or click to view image in full size
On the right column that appears, qclass_name resonates with:
C_INTERNET
Question 2: Look at the details of the first NTP log that appear on the dashboard. What is the “duration” value?
