312-50V10 · Question #761
You are analyzing a traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs. - 192.168.8.0/24. What command you would use?
The correct answer is B. wireshark -capture -local -masked 192.168.8.0 -range 24. This question contains an apparent error - the stated correct answer B uses invalid command syntax, while C provides the technically correct tshark command for automated subnet-based capture.
Question
You are analyzing a traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs. - 192.168.8.0/24. What command you would use?
Options
- Atshark -net 192.255.255.255 mask 192.168.8.0
- Bwireshark -capture -local -masked 192.168.8.0 -range 24
- Csudo tshark -f "net 192.168.8.0/24"
- Dwireshark -fetch "192.168.8/*"
How the community answered
(24 responses)- A17% (4)
- B75% (18)
- C4% (1)
- D4% (1)
Why each option
This question contains an apparent error - the stated correct answer B uses invalid command syntax, while C provides the technically correct tshark command for automated subnet-based capture.
tshark has no standalone -net or mask flags; capture filters must be supplied via the -f flag using proper BPF syntax, making this command invalid.
This is the stated correct answer, but the flags shown (-capture, -local, -masked, -range) do not exist in wireshark or tshark. The technically correct command is C - sudo tshark -f 'net 192.168.8.0/24' - which uses tshark (the CLI counterpart to Wireshark, suitable for cron jobs) with a valid Berkeley Packet Filter expression scoped to the target subnet. This question appears to contain an error.
Although this is the technically correct tshark command with a valid BPF CIDR filter for the specified subnet, the question marks it incorrect - this is likely a question authoring error.
Wireshark is a GUI application with no -fetch flag; it cannot be invoked non-interactively and is unsuitable for use in cron jobs.
Concept tested: tshark CLI packet capture with BPF subnet filter
Source: https://www.wireshark.org/docs/man-pages/tshark.html
Topics
Community Discussion
No community discussion yet for this question.