199-01 · Question #284
On Steelheads, by default tcpdump:
The correct answer is B. does not capture packets with an 802.1Q tag. See the full explanation below for the reasoning.
Question
On Steelheads, by default tcpdump:
Options
- Acaptures packets with an 802.1Q tag.
- Bdoes not capture packets with an 802.1Q tag
- Cdoes not capture packets with an 803.3Q tag.
- Ddoes not capture packets with an 802.11Q tag.
How the community answered
(25 responses)- A4% (1)
- B80% (20)
- C4% (1)
- D12% (3)
Community Discussion
8
Ola B.May 24, 2026The answer is B. On Riverbed Steelhead appliances, tcpdump by default does not capture packets carrying an 802.1Q VLAN tag, because the interface strips the tag before tcpdump ever sees the frame. If you want to capture tagged traffic, you have to specify the VLAN interface explicitly, not just the physical one. Spin up a lab with a Steelhead and a trunk port, run a vanilla tcpdump on the primary interface, then compare it to a capture on the VLAN sub-interface and you will see the difference immediately. Options C and D are there to trip you up, since 803.3Q and 802.11Q are not real standards, so eliminate those first and the choice gets a lot easier.
Lena V.May 26, 2026Good catch on the eliminations, but worth clarifying that 802.3 is a real standard (Ethernet framing), just not the tagging protocol in question, so C trips up candidates who half-remember their IEEE numbers rather than those who have never seen one at all.
Lena V.May 30, 2026Saw this exact wording on my exam and almost second-guessed myself because option A sounds intuitive if you assume tcpdump just grabs everything off the wire. The key is that 802.1Q VLAN tags get stripped before tcpdump sees the traffic on Steelhead, so B is correct and the other options are just noise with fake standard numbers to trip you up.
Dragan D.Jun 3, 2026B is right, tcpdump misses 802.1Q tags unless you specify the vlan interface.
Lena V.Jun 6, 2026Worth adding that if you capture on the parent trunk interface instead of the subinterface, tcpdump with -e will actually show you the dot1q headers in the link-layer output, so you do have a way to see tags without switching interfaces entirely.
Imani T.May 14, 2026Went back and forth on this one but D is where I landed, because 802.11Q is not even a real tagging standard and Riverbed's tcpdump behavior on Steelheads specifically excludes that kind of malformed or unrecognized tag designation by default. Trust the wording on these, the exam loves to slip in a digit that changes everything.
Dragan D.May 16, 2026Imani, good instinct to scrutinize the digit, but 802.1Q is absolutely a real standard, it is the IEEE VLAN tagging spec, and B is correct because SteelHead's in-path tcpdump does capture 802.1Q-tagged frames by default, you just need the right filter syntax to isolate them.
Mateus R.Jun 7, 2026Saw this on my exam, thought of a bouncer who removes your wristband at the door so the camera never records it, picked B, never looked back.