nerdexam
Cisco

210-255 · Question #33

Which option creates a display filter on Wireshark on a host IP address or name?

The correct answer is D. ip.addr == <addr> or ip.host == <host>. Wireshark display filters use ip.addr to match by IP address and ip.host to match by resolved hostname.

Network Intrusion Analysis

Question

Which option creates a display filter on Wireshark on a host IP address or name?

Options

  • Aip.address == <address> or ip.network == <network>
  • B[tcp|udp] ip.[src|dst] port <port>
  • Cip.addr == <addr> or ip.name == <name>
  • Dip.addr == <addr> or ip.host == <host>

How the community answered

(21 responses)
  • C
    5% (1)
  • D
    95% (20)

Why each option

Wireshark display filters use ip.addr to match by IP address and ip.host to match by resolved hostname.

Aip.address == <address> or ip.network == <network>

ip.address and ip.network are not valid Wireshark display filter field names; the correct field for address matching is ip.addr.

B[tcp|udp] ip.[src|dst] port <port>

This syntax resembles tcpdump capture filter syntax focused on ports, not a Wireshark display filter for filtering by host address or name.

Cip.addr == <addr> or ip.name == <name>

ip.name is not a valid Wireshark display filter field; the correct field for hostname-based filtering is ip.host.

Dip.addr == <addr> or ip.host == <host>Correct

Wireshark's display filter language supports ip.addr == <addr> to match any packet where the source or destination IP equals the specified address, and ip.host == <host> to match packets by resolved DNS hostname. These are the two valid built-in filter fields for identifying traffic by host identity. Using the 'or' operator between them allows either an address or a name match to return results.

Concept tested: Wireshark display filter syntax for host identification

Source: https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html

Topics

#Wireshark#display filter#IP address filter#packet filtering

Community Discussion

No community discussion yet for this question.

Full 210-255 Practice