nerdexam
EC-Council

312-50V10 · Question #761

You are analyzing a traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs. - 192.168.8.0/24. What command you would use?

The correct answer is B. wireshark -capture -local -masked 192.168.8.0 -range 24. This question contains an apparent error - the stated correct answer B uses invalid command syntax, while C provides the technically correct tshark command for automated subnet-based capture.

Sniffing

Question

You are analyzing a traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs. - 192.168.8.0/24. What command you would use?

Options

  • Atshark -net 192.255.255.255 mask 192.168.8.0
  • Bwireshark -capture -local -masked 192.168.8.0 -range 24
  • Csudo tshark -f "net 192.168.8.0/24"
  • Dwireshark -fetch "192.168.8/*"

How the community answered

(24 responses)
  • A
    17% (4)
  • B
    75% (18)
  • C
    4% (1)
  • D
    4% (1)

Why each option

This question contains an apparent error - the stated correct answer B uses invalid command syntax, while C provides the technically correct tshark command for automated subnet-based capture.

Atshark -net 192.255.255.255 mask 192.168.8.0

tshark has no standalone -net or mask flags; capture filters must be supplied via the -f flag using proper BPF syntax, making this command invalid.

Bwireshark -capture -local -masked 192.168.8.0 -range 24Correct

This is the stated correct answer, but the flags shown (-capture, -local, -masked, -range) do not exist in wireshark or tshark. The technically correct command is C - sudo tshark -f 'net 192.168.8.0/24' - which uses tshark (the CLI counterpart to Wireshark, suitable for cron jobs) with a valid Berkeley Packet Filter expression scoped to the target subnet. This question appears to contain an error.

Csudo tshark -f "net 192.168.8.0/24"

Although this is the technically correct tshark command with a valid BPF CIDR filter for the specified subnet, the question marks it incorrect - this is likely a question authoring error.

Dwireshark -fetch "192.168.8/*"

Wireshark is a GUI application with no -fetch flag; it cannot be invoked non-interactively and is unsuitable for use in cron jobs.

Concept tested: tshark CLI packet capture with BPF subnet filter

Source: https://www.wireshark.org/docs/man-pages/tshark.html

Topics

#tshark#packet capture#network filtering#subnet capture

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice