تحليل تدفق البيانات بخيار معلومات الخبير - كتاب الأمن السيبراني - الصف 12 - الفصل 1 - المملكة العربية السعودية

تحليل تدفق البيانات بخيار معلومات الخبير Analyzing Data Flow with Expert Information يُقدم واير شارك خيار معلومات الخبير (Expert Information) لتحديد مشكلات الشبكة، وأي سلوك أو نشاط مشبوه، بما يساعد غير المتخصصين في تحديد هذه الأنشطة. --- SECTION: لتفعيل خيار معلومات الخبير (Expert Information) --- لتفعيل خيار معلومات الخبير (Expert Information) < من علامة تبويب Analyze (تحليل)، اضغط على خيار Expert Information (معلومات الخبير). 1 < سيتم التعرف على النشاط المشبوه بواسطة نظام معلومات الخبير. 2 --- SECTION: شكل 2.18: تفعيل خيار معلومات الخبير (Expert Information) --- شكل 2.18: تفعيل خيار معلومات الخبير (Expert Information) وزارة التعليم Ministry of Education 2025 - 1447 79 --- VISUAL CONTEXT --- **FIGURE**: شكل 2.18: تفعيل خيار معلومات الخبير (Expert Information) Description: A screenshot of the Wireshark network protocol analyzer software interface. The interface shows multiple panels: a packet list, packet details, and an 'Expert Information' panel. The 'Analyze' menu is open, with the 'Expert Information' option highlighted, illustrating the steps described in the accompanying text for identifying network issues. Table Structure: Headers: No. | Time | Source | Protocol | Length | Info | Severity | Summary | Group | Protocol Rows: Row 1: 16 | 0.417202 | 199.0 | DNS | 81 | Standard query 0x0000 A desktop-22jfbm6.local, "QM" quest | EMPTY | EMPTY | EMPTY | EMPTY Row 2: 17 | 0.417646 | 199.0 | LLMNR | 75 | Standard query 0xa69d AAAA desktop-22jfbm6 | EMPTY | EMPTY | EMPTY | EMPTY Row 3: 18 | 0.417909 | 199.0 | LLMNR | 75 | Standard query 0xa69d AAAA desktop-22jfbm6 | EMPTY | EMPTY | EMPTY | EMPTY Row 4: 19 | 0.418568 | Dell | DNS | 68 | Who has 199.0.0.56? Tell 199.0.0.175 | EMPTY | EMPTY | EMPTY | EMPTY Row 5: 20 | 0.429431 | 199.0 | TCP | 104 | Application Data | EMPTY | EMPTY | EMPTY | EMPTY Row 6: 21 | 0.429507 | 199.0 | TCP | 54 | 3389 → 59329 [ACK] Seq=38 Ack=237 Win=62541 Len=0 | EMPTY | EMPTY | EMPTY | EMPTY Row 7: 22 | 0.441982 | 199.0 | TCP | 391 | 3389 → 56890 Len=349 | EMPTY | EMPTY | EMPTY | EMPTY Row 8: 23 | 0.446664 | 199.0 | TLSv1.2 | 104 | Application Data | EMPTY | EMPTY | EMPTY | EMPTY Row 9: 24 | 0.462240 | 199.0 | TLSv1.2 | 104 | Application Data | EMPTY | EMPTY | EMPTY | EMPTY Row 10: 25 | 0.462313 | 199.0 | TLSv1.2 | 104 | Application Data | Warning | Previous segment(s) not captured (common at capture start) | Sequence | TCP Row 11: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | Warning | ACKed segment that wasn't captured (common at capture start) | Sequence | TCP Row 12: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | Warning | Connection reset (RST) | Sequence | TCP Row 13: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | Warning | DNS query retransmission. Original request in frame 17 | Protocol | LLMNR Row 14: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | Warning | DNS query retransmission. Original request in frame 15 | Protocol | mDNS Row 15: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | Note | "Time To Live" is 255 for a packet sent to the Local Network Control Block (see RFC 3171) | Sequence | IPv4 Row 16: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | 15 | Standard query 0x0000 A desktop-22jfbm6.local, "QM" question | Sequence | IPv4 Row 17: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | 16 | Standard query 0x0000 A desktop-22jfbm6.local, "QM" question | Sequence | IPv4 Row 18: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | 117 | Standard query 0x0000 A desktop-22jfbm6.local, "QM" question | Sequence | IPv4 Row 19: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | 154 | Standard query 0x0000 A desktop-22jfbm6.local, "QM" question | Sequence | IPv4 Row 20: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | 155 | Standard query 0x0000 A desktop-22jfbm6.local, "QM" question | Sequence | IPv4 Row 21: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | 186 | Standard query 0x0000 A desktop-22jfbm6.local, "QM" question | Sequence | IPv4 Row 22: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | 187 | Standard query 0x0000 A desktop-22jfbm6.local, "QM" question | Sequence | IPv4 Row 23: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | 357 | Standard query 0x0000 A desktop-22jfbm6.local, "QM" question | Sequence | IPv4 Row 24: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | 358 | Standard query 0x0000 A desktop-22jfbm6.local, "QM" question | Sequence | IPv4 Row 25: EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | EMPTY | 473 | Standard query 0x0000 A desktop-22jfbm6.local, "QM" question | Sequence | IPv4 Empty cells: The 'Severity', 'Summary', 'Group', and 'Protocol' columns are empty for the first 10 rows (packet list data)., The 'No.', 'Time', 'Source', 'Protocol', 'Length', and 'Info' columns are empty for the rows corresponding to the 'Expert Information' panel data (from 'Warning, Previous segment(s)...' onwards). Calculation needed: No calculations are needed; this is a data display. Data: The screenshot displays various network packet data and analysis results. The top-left panel lists packets with columns for No., Time, Source, Protocol, Length, and Info. The middle-left panel shows detailed information for a selected packet (Frame 19, Address Resolution Protocol). The bottom-left panel, titled 'Wireshark - Expert Information - Ethernet', lists network events categorized by Severity (Warning, Note), Summary, Group, and Protocol, indicating potential issues like 'Previous segment(s) not captured', 'Connection reset', 'DNS query retransmission', and 'Standard query' messages. The 'Analyze' menu is shown open, with 'Expert Information' selected. Key Values: Wireshark software interface, Analyze menu, Expert Information option, Packet list (No., Time, Source, Protocol, Length, Info), Packet details (Frame 19, Ethernet II, ARP), Expert Information panel (Severity, Summary, Group, Protocol), Packet data examples: DNS, LLMNR, TCP, TLSv1.2, Expert messages: Warning, Note, Specific messages: 'Previous segment(s) not captured', 'Connection reset (RST)', 'DNS query retransmission', 'Time To Live' is 255, Menu items: File, Edit, View, Go, Capture, Analyze, Statistics, Telephony, Wireless, Tools, Help, Analyze dropdown options: Display Filters..., Apply as Column, Expert Information Context: This visual demonstrates the practical application of the 'Expert Information' feature in Wireshark, a network analysis tool, as described in the text. It shows how to access the feature and the type of diagnostic information it provides to help identify network problems or suspicious activities.