nerdexam
Cisco

300-710 · Question #273

An engineer is troubleshooting HTTP traffic to a web server using the packet capture tool on Cisco FMC. When reviewing the captures, the engineer notices that there are a lot of packets that are not s

The correct answer is A. Use the host filter in the packet capture to capture traffic to or from a specific host.. To reduce the strain of capturing irrelevant traffic on a Cisco FTD device during troubleshooting, the engineer should use the host filter in the packet capture configuration to target traffic to or from a specific host.

Management and Troubleshooting

Question

An engineer is troubleshooting HTTP traffic to a web server using the packet capture tool on Cisco FMC. When reviewing the captures, the engineer notices that there are a lot of packets that are not sourced from or destined to the web server being captured. How can the engineer reduce the strain of capturing packets for irrelevant traffic on the Cisco FTD device?

Options

  • AUse the host filter in the packet capture to capture traffic to or from a specific host.
  • BRedirect the packet capture output to a .pcap file that can be opened with Wireshark.
  • CUse the -c option to restrict the packet capture to only the first 100 packets.
  • DUse an access-list within the packet capture to permit only HTTP traffic to and from the web

How the community answered

(37 responses)
  • A
    81% (30)
  • B
    11% (4)
  • C
    5% (2)
  • D
    3% (1)

Why each option

To reduce the strain of capturing irrelevant traffic on a Cisco FTD device during troubleshooting, the engineer should use the host filter in the packet capture configuration to target traffic to or from a specific host.

AUse the host filter in the packet capture to capture traffic to or from a specific host.Correct

Using a host filter in the packet capture utility allows precise specification of the source or destination IP address, ensuring that only traffic involving the web server is captured. This dramatically reduces the volume of irrelevant packets and the associated processing burden on the FTD device.

BRedirect the packet capture output to a .pcap file that can be opened with Wireshark.

Redirecting packet capture output to a .pcap file is about storage and analysis, not about filtering the data captured at the source to reduce device strain.

CUse the -c option to restrict the packet capture to only the first 100 packets.

Using an option like -c to limit the number of packets captured will still capture irrelevant traffic, just fewer of them, and might miss the crucial relevant packets if they occur later.

DUse an access-list within the packet capture to permit only HTTP traffic to and from the web

While an access-list can filter traffic, a host filter is a more direct and often simpler method for focusing on a single host in packet capture, achieving the goal of reducing irrelevant traffic efficiently.

Concept tested: Cisco FTD packet capture filtering

Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-70/device_management.html

Topics

#Packet Capture#Troubleshooting#Cisco FTD/FMC#Traffic Filtering

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-710 Practice