nerdexam
Cisco

200-201 · Question #246

Refer to the exhibit. What must be interpreted from this packet capture?

The correct answer is B. IP address 192.168.88.12 is communicating with 192.168 88.149 with a source port 49098 to. Based on a typical packet capture display, the communication originates from IP 192.168.88.12 using an ephemeral source port 49098, destined for IP 192.168.88.149 on port 80 (HTTP).

Submitted by haru.x· Mar 6, 2026Network Intrusion Analysis

Question

Refer to the exhibit. What must be interpreted from this packet capture?

Exhibit

200-201 question #246 exhibit

Options

  • AIP address 192.168.88,12 is communicating with 192.168.88.149 with a source port 74 to
  • BIP address 192.168.88.12 is communicating with 192.168 88.149 with a source port 49098 to
  • CIP address 192.168.88.149 is communicating with 192.168 88.12 with a source port 80 to
  • DIP address 192.168.88.149 is communicating with 192.168.88.12 with a source port 49098 to

How the community answered

(36 responses)
  • A
    3% (1)
  • B
    75% (27)
  • C
    17% (6)
  • D
    6% (2)

Why each option

Based on a typical packet capture display, the communication originates from IP 192.168.88.12 using an ephemeral source port 49098, destined for IP 192.168.88.149 on port 80 (HTTP).

AIP address 192.168.88,12 is communicating with 192.168.88.149 with a source port 74 to

The source port 74 is incorrect for an ephemeral client port in this context; 49098 is typical for a client ephemeral port.

BIP address 192.168.88.12 is communicating with 192.168 88.149 with a source port 49098 toCorrect

In a standard packet capture (e.g., Wireshark), a client initiating an HTTP request to a web server typically uses an ephemeral source port and sends traffic to the server's well-known HTTP port 80. Thus, 192.168.88.12 is the client (source), 192.168.88.149 is the server (destination), and the source port 49098 is an ephemeral client port communicating with destination port 80.

CIP address 192.168.88.149 is communicating with 192.168 88.12 with a source port 80 to

This choice incorrectly reverses the source and destination IPs and identifies port 80 as a source port, which is incorrect for a client-initiated HTTP connection.

DIP address 192.168.88.149 is communicating with 192.168.88.12 with a source port 49098 to

While source port 49098 is plausible for a client, this choice reverses the source and destination IPs, indicating 192.168.88.149 as the source, which contradicts a client initiating a connection to port 80.

Concept tested: Interpreting packet capture headers

Topics

#packet capture#TCP/IP#IP addresses#port numbers#network interpretation

Community Discussion

No community discussion yet for this question.

Full 200-201 Practice