Which of the following statements are valid wireshark capture filters? (Choose TWO correct answers.)

Question

Options

• Aport range 10000:tcp-15000:tcp
• Bport-range tcp 10000-15000
• Ctcp portrange 10000-15000
• Dportrange 10000/tcp-15000/tcp
• Eportrange 10000-15000 and tcp

• A
  3% (1)
• B
  12% (4)
• C
  82% (28)
• D
  3% (1)

Explanation

Wireshark capture filters use BPF (Berkeley Packet Filter) syntax, which has strict rules. C (tcp portrange 10000-15000) is valid because BPF allows a protocol qualifier placed before the portrange keyword, with ports separated by a hyphen. E (portrange 10000-15000 and tcp) is equally valid - you can combine portrange with a logical and tcp clause when the protocol qualifier comes after.

The distractors fail for specific syntax reasons: A uses port range as two words (invalid - must be portrange) and appends :tcp to each port number, which BPF doesn't recognize. B uses port-range with a hyphen instead of the one-word portrange keyword. D appends /tcp after each port number (e.g., 10000/tcp), which is not valid BPF portrange syntax.

Memory tip: Think "BPF is picky - one word (portrange), one hyphen (between port numbers), and the protocol either leads (tcp portrange ...) or follows with and (portrange ... and tcp)." Any deviation in punctuation or word structure makes the filter invalid.

No community discussion yet for this question.