312-50V10 · Question #186
As an Ethical Hacker you are capturing traffic from your customer network with Wireshark and you need to find and verify just SMTP traffic. What command in Wireshark will help you to find this kind of
The correct answer is B. tcp.port eq 25. Wireshark uses a specific display filter syntax to isolate traffic; tcp.port eq 25 correctly filters all TCP traffic on port 25, the standard SMTP port.
Question
As an Ethical Hacker you are capturing traffic from your customer network with Wireshark and you need to find and verify just SMTP traffic. What command in Wireshark will help you to find this kind of traffic?
Options
- Arequest smtp 25
- Btcp.port eq 25
- Csmtp port
- Dtcp.contains port 25
How the community answered
(38 responses)- A3% (1)
- B87% (33)
- C3% (1)
- D8% (3)
Why each option
Wireshark uses a specific display filter syntax to isolate traffic; tcp.port eq 25 correctly filters all TCP traffic on port 25, the standard SMTP port.
request smtp 25 is not a recognized Wireshark display filter expression; Wireshark does not support this keyword-based syntax.
tcp.port eq 25 is valid Wireshark display filter syntax that matches any TCP packet where either the source or destination port equals 25, which is the well-known port assigned to SMTP. This filter isolates SMTP sessions from all other captured traffic, allowing the analyst to inspect email transmission in detail. No other option uses correct Wireshark display filter grammar.
smtp port is not valid Wireshark display filter syntax; while Wireshark does have an smtp protocol dissector, the filter must reference a field name such as tcp.port.
tcp.contains searches for a byte sequence within a packet payload, not for a port number value, so it cannot be used to filter by port.
Concept tested: Wireshark display filter syntax for port-based filtering
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html
Topics
Community Discussion
No community discussion yet for this question.