LPI
201-450 · Question #14
You find that a host (192.168.1.4) being used on one of your client's networks has been compromised with a backdoor program listening on port 31337. Your client requests a list of originating IP…
The correct answer is A. tcpdump host 192.168.1.4 and port 31337 -w out. See the full explanation below for the reasoning.
206 Networking Configuration
Question
You find that a host (192.168.1.4) being used on one of your client's networks has been compromised with a backdoor program listening on port 31337. Your client requests a list of originating IP addresses connecting to that port. Using a Linux workstation as traffic analyzer, which of the following commands would gather the data requested by the client?
Options
- Atcpdump host 192.168.1.4 and port 31337 -w out
- Bnmap host 192.168.1.4:31337
- Carpwatch -n 192.168.1.4/32 -p 31337 > capture
- Dpcap -d 192.168.1.4:31337
- Eipwatch --syn 192.168.1.4 -p 31337 --1og=out
How the community answered
(43 responses)- A79% (34)
- B2% (1)
- C9% (4)
- D5% (2)
- E5% (2)
Topics
#tcpdump#packet capture#network monitoring#port filtering
Community Discussion
No community discussion yet for this question.