Question 26
An unusually high number of RSTs or a high number of SYN/ACKs with no related data transfer is a strong indication that a TCP scan is underway.
Question 27
Wireshark's Export feature can be used to identify HTTP objects and reassemble them into their original format.
Question 28
The UDP header checksum isoptional.
Question 29
Wireshark contains numerous pre-defined columns that can be added easily to the Packet List pane.
Question 30
Window scaling is established during the TCP handshake process to enable hosts to use larger window sizes than is 65,535.