210-255 · Question #33
Which option creates a display filter on Wireshark on a host IP address or name?
The correct answer is D. ip.addr == <addr> or ip.host == <host>. Wireshark display filters use ip.addr to match by IP address and ip.host to match by resolved hostname.
Question
Which option creates a display filter on Wireshark on a host IP address or name?
Options
- Aip.address == <address> or ip.network == <network>
- B[tcp|udp] ip.[src|dst] port <port>
- Cip.addr == <addr> or ip.name == <name>
- Dip.addr == <addr> or ip.host == <host>
How the community answered
(21 responses)- C5% (1)
- D95% (20)
Why each option
Wireshark display filters use ip.addr to match by IP address and ip.host to match by resolved hostname.
ip.address and ip.network are not valid Wireshark display filter field names; the correct field for address matching is ip.addr.
This syntax resembles tcpdump capture filter syntax focused on ports, not a Wireshark display filter for filtering by host address or name.
ip.name is not a valid Wireshark display filter field; the correct field for hostname-based filtering is ip.host.
Wireshark's display filter language supports ip.addr == <addr> to match any packet where the source or destination IP equals the specified address, and ip.host == <host> to match packets by resolved DNS hostname. These are the two valid built-in filter fields for identifying traffic by host identity. Using the 'or' operator between them allows either an address or a name match to return results.
Concept tested: Wireshark display filter syntax for host identification
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html
Topics
Community Discussion
No community discussion yet for this question.