150-420 · Question #103
What does the command shown below accomplish? ServerIron(debug-filter-spec-1)# pattern 24 2 1203
The correct answer is A. Captures packets that contain a pattern of a specified length; starting from a specified offset from the. See the full explanation below for the reasoning.
Question
What does the command shown below accomplish? ServerIron(debug-filter-spec-1)# pattern 24 2 1203
Options
- ACaptures packets that contain a pattern of a specified length; starting from a specified offset from the
- BCaptures packets that contain a pattern of a specified field; and a specified length beginning of the packet.
- CCaptures packets that contain a pattern of a specified length;, starting from a specified offset from the end
- DCaptures packets that contain a pattern of a specified field; and a specified length end of the packet.
How the community answered
(63 responses)- A73% (46)
- B8% (5)
- C5% (3)
- D14% (9)
Community Discussion
11The answer is A, because the syntax for the pattern command goes offset first, then length, then the hex pattern, so "pattern 24 2 1203" means start at byte offset 24 from the beginning of the packet and match 2 bytes worth of the pattern 1203. Options C and D try to say "end of the packet," which flips the offset direction and does not match how ServerIron reads that command.
Right, and the other thing that got me on a similar question was remembering that the hex pattern itself does not use a 0x prefix in the command, so if you see "0x1203" as a choice it is already wrong before you even think about the offset direction.
Answer is A. The "pattern" command takes a length and an offset from the beginning of the packet, so "pattern 24 2 1203" is telling the filter to capture packets containing a 24-bit pattern starting 2 bytes from the start of the packet, which matches what A describes. B, C, and D each swap in wrong terms like "field" or "end of the packet," which is not how this command works.
C trips people up because "offset from the end" sounds like it could make sense for some filtering scenarios, but the command syntax here is offset from the beginning of the packet, so A is correct even though the answer text looks like it got cut off in whatever database this came from.
Right, and what helped it lock in for me was thinking of BPF like a ruler starting at byte zero on the left side of the packet, so the offset is always a fixed distance from the front, never some sliding count from the back.
A is correct, and the syntax locks it in: the three arguments after "pattern" map to offset, length, and value in that order, so "24 2 1203" means find the two-byte value 1203 starting at byte offset 24 counted from the beginning of the packet. Remember the mnemonic OLV, Offset then Length then Value, and you will never mix up which direction the offset counts from.
Yeah A is right, the numbers in that command map to offset and length measured from the start of the packet, not the end. My senior showed me that the first argument after "pattern" is the byte offset from the beginning, so 24 here means it starts looking 24 bytes in before checking for that 2-byte value 1203.
Worth adding that the offset counts from the start of whichever protocol header you anchor to, so if your filter says tcp[24:2] the 24 bytes are measured from the top of the TCP header, not the Ethernet or IP header, and mixing those up is where most people get burned on the exam questions.
I initially leaned toward C because "offset from the end" sounded plausible given how some debug filter implementations count backwards, but then I went back to the Brocade ServerIron traffic filter docs and confirmed that the offset in the pattern command is always measured from the beginning of the packet, not the end, which locks in A. The syntax "pattern 24 2 1203" maps to pattern-id, offset from start, length, value, so "starting from a specified offset from the beginning of the packet" is the only accurate description here.
The offset value in that command counts from the end of the packet, not the beginning, which is exactly what option C describes. Pattern 24 gives you the length and 2 gives the offset position measured from the packet tail, so C lines up perfectly with how that syntax actually works.
Carlos, the offset actually measures from the start of the packet header, not the tail, so option A is correct. The value 2 tells the engine to begin its match 2 bytes in from the front of the relevant header, which is the standard behavior for that filter syntax.