nerdexam
Cisco

210-255 · Question #18

Which option filters a LibPCAP capture that used a host as a gateway?

The correct answer is D. gateway host <host>. The LibPCAP 'gateway host' primitive filters packets where the named host acted as a Layer 3 gateway by matching its MAC address in the Ethernet header but not its IP in the network header.

Network Intrusion Analysis

Question

Which option filters a LibPCAP capture that used a host as a gateway?

Options

  • Atcp|udp] [src|dst] port <port>
  • B[src|dst] net <net> [{mask <mask>}|{len <len>}]
  • Cether [src|dst] host <ehost>
  • Dgateway host <host>

How the community answered

(28 responses)
  • B
    4% (1)
  • C
    4% (1)
  • D
    93% (26)

Why each option

The LibPCAP 'gateway host' primitive filters packets where the named host acted as a Layer 3 gateway by matching its MAC address in the Ethernet header but not its IP in the network header.

Atcp|udp] [src|dst] port <port>

The tcp|udp [src|dst] port syntax filters by transport-layer port number and has no logic to detect whether a host acted as a routing gateway.

B[src|dst] net <net> [{mask <mask>}|{len <len>}]

The [src|dst] net syntax filters by the IP network address of the source or destination endpoint, not by the intermediate gateway that forwarded the packet.

Cether [src|dst] host <ehost>

The ether [src|dst] host syntax matches only on Ethernet MAC address and does not apply the combined Ethernet-versus-IP comparison required to isolate gateway-forwarded traffic.

Dgateway host <host>Correct

The 'gateway host <host>' filter matches packets where the host appears as the Ethernet-layer source or destination (MAC address) but is neither the IP source nor IP destination - precisely capturing traffic that was routed through that host as a gateway, not traffic to or from it.

Concept tested: LibPCAP gateway host capture filter syntax

Source: https://www.tcpdump.org/manpages/pcap-filter.7.html

Topics

#LibPCAP#packet capture filters#tcpdump#gateway filtering

Community Discussion

No community discussion yet for this question.

Full 210-255 Practice