An engineer wants to perform a packet capture on the Cisco FTD to confirm that the host using IP address 192.168.100.100 has the MAC address of 1234.5678.901 to help troubleshoot a connectivity…

The correct answer is B. -ne src 192.168.100.100. The tcpdump flag -e instructs the tool to print the link-level (Ethernet frame) header for each packet, which includes source and destination MAC addresses. Without -e, tcpdump only displays Layer 3 and above information, so MAC addresses would not appear in the output. The -n…

Management and Troubleshooting

Question

An engineer wants to perform a packet capture on the Cisco FTD to confirm that the host using IP address 192.168.100.100 has the MAC address of 1234.5678.901 to help troubleshoot a connectivity issue. What is the correct tcpdump command syntax to ensure that the MAC address appears in the packet capture output?

Options

A-nm src 192.168.100.100
B-ne src 192.168.100.100
C-w capture.pcap -s 1518 host 192.168.100.100 mac
D-w capture.pcap -s 1518 host 192.168.100.100 ether

How the community answered

(60 responses)

A
3% (2)
B
93% (56)
C
2% (1)
D
2% (1)

Explanation

The tcpdump flag -e instructs the tool to print the link-level (Ethernet frame) header for each packet, which includes source and destination MAC addresses. Without -e, tcpdump only displays Layer 3 and above information, so MAC addresses would not appear in the output. The -n flag disables hostname resolution, keeping the IP address visible as-is. Combined as -ne src 192.168.100.100, this captures packets from that IP and displays both the MAC address and IP information. Option A (-nm) is incorrect because -m loads a MIB module file, not Ethernet headers. Options C and D use incorrect syntax; mac and ether are not valid filter keywords in this form for triggering MAC display - -e is the correct flag for that purpose.

Topics

#tcpdump#Packet Capture#Troubleshooting#Cisco FTD

Community Discussion

No community discussion yet for this question.

Full 300-710 Practice