nerdexam
LPI

117-201 · Question #14

You find that a host (192.168.1.4) being used on one of your client's networks has been compromised with a backdoor program listening on port 31337. Your client requests a list of originating IP…

The correct answer is A. tcpdump host 192.168.1.4 and port 31337 -w out. See the full explanation below for the reasoning.

Question

You find that a host (192.168.1.4) being used on one of your client's networks has been compromised with a backdoor program listening on port 31337. Your client requests a list of originating IP addresses connecting to that port. Using a Linux workstation as traffic analyzer, which of the following commands would gather the data requested by the client?

Options

  • Atcpdump host 192.168.1.4 and port 31337 -w out
  • Bnmap host 192.168.1.4:31337
  • Carpwatch -n 192.168.1.4/32 -p 31337 > capture
  • Dpcap -d 192.168.1.4:31337
  • Eipwatch --syn 192.168.1.4 -p 31337 --1og=out

How the community answered

(27 responses)
  • A
    70% (19)
  • B
    4% (1)
  • C
    15% (4)
  • D
    4% (1)
  • E
    7% (2)

Community Discussion

No community discussion yet for this question.

Full 117-201 Practice