Exam GICSP Topic 1 Question 57 Discussion

Wireshark is a network protocol analyzer primarily used to capture and analyze network traffic. At Purdue levels 0 or 1 (which include physical devices like sensors, actuators, and controllers communicating over industrial protocols), Wireshark can be used to:
Capture serial and fieldbus communications (A), such as Modbus, Profibus, or Ethernet-based protocols, if the network media is accessible. This can reveal sensitive operational data and control commands.
Wireshark cannot capture communications between chips on a board (B) because this is hardware-level, not network traffic.
Detecting open ports by sending packets (C) is a function of port scanning tools, not Wireshark.
Detecting asymmetrical keys or brute forcing crypto keys (D and E) are not capabilities of Wireshark.
The GICSP training highlights the risk of passive monitoring via tools like Wireshark as a means for attackers to gain insight into control system operations.
Reference:
GICSP Official Study Guide, Domain: ICS Security Operations & Incident Response NIST SP 800-82 Rev 2, Section 7.5 (Monitoring and Analysis Tools) GICSP Training on Network Traffic Analysis and ICS Attack Vectors