312-50V11 · Question #186
As an Ethical Hacker you are capturing traffic from your customer network with Wireshark and you need to find and verify just SMTP traffic. What command in Wireshark will help you to find this kind…
The correct answer is B. tcp.port eq 25. Wireshark uses display filter syntax to isolate traffic by protocol or port. The correct filter for SMTP is tcp.port eq 25, since SMTP operates over TCP on port 25.
Question
As an Ethical Hacker you are capturing traffic from your customer network with Wireshark and you need to find and verify just SMTP traffic. What command in Wireshark will help you to find this kind of traffic?
Options
- Arequest smtp 25
- Btcp.port eq 25
- Csmtp port
- Dtcp.contains port 25
How the community answered
(23 responses)- A4% (1)
- B96% (22)
Why each option
Wireshark uses display filter syntax to isolate traffic by protocol or port. The correct filter for SMTP is tcp.port eq 25, since SMTP operates over TCP on port 25.
'request smtp 25' is not valid Wireshark display filter syntax - Wireshark does not use keyword-based commands in this format.
Wireshark display filters use a structured syntax where tcp.port eq 25 matches any TCP packet where either the source or destination port is 25 - the standard SMTP port. This is the correct and complete Wireshark filter expression that captures both inbound and outbound SMTP traffic reliably.
'smtp port' is not a recognized Wireshark display filter expression and will produce a filter error.
'tcp.contains' is used to search for byte sequences within TCP payloads, not to filter by port number, making this both syntactically incorrect and functionally wrong for port-based filtering.
Concept tested: Wireshark display filter syntax for SMTP traffic
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html
Topics
Community Discussion
No community discussion yet for this question.