156-915.80 · Question #512
What is the correct command to observe the Sync traffic in a VRRP environment?
The correct answer is D. fw monitor -e "accept dst=224.0.0.18;". See the full explanation below for the reasoning.
Question
What is the correct command to observe the Sync traffic in a VRRP environment?
Options
- Afw monitor -e "accept [12:4,b]=224.0.0.18;"
- Bfw monitor -e "accept port(6118;"
- Cfw monitor -e "accept proto=mcVRRP;"
- Dfw monitor -e "accept dst=224.0.0.18;"
How the community answered
(49 responses)- A6% (3)
- B12% (6)
- C2% (1)
- D80% (39)
Community Discussion
4
Anastasia B.Jun 27, 2026Answer is D. VRRP sends its advertisement packets to the well-known multicast destination 224.0.0.18, so filtering on dst=224.0.0.18 in fw monitor is the clean, direct way to catch that traffic at any inspection point on the gateway. Options A and B use malformed syntax that will error out, and C invents a protocol keyword that does not exist in the fw monitor filter language.
Dervla O.Jun 28, 2026D is solid but worth adding that even with the right filter you want to specify the inspection point explicitly, otherwise fw monitor defaults can leave you blind at certain chain positions depending on your gateway version.
Nina C.Jun 26, 2026This one tripped me up on my attempt last month because I second-guessed myself and almost picked A thinking the byte-offset filter looked more "technical," but then I remembered that VRRP uses 224.0.0.18 as its multicast destination and fw monitor filtering on dst is the straightforward way to catch that traffic. Went back and changed it to D and it was right.
Dervla O.Jun 23, 2026A is a classic byte-offset trap, D gives you the multicast destination cleanly.