nerdexam
EC-Council

312-50V11 · Question #422

You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perform a syn sca

The correct answer is A. tcp.dstport==514 && ip.dst==192.168.0.150. We need to configure destination port at destination ip. The destination ip is 192.168.0.150, where the kiwi syslog is installed. https://wiki.wireshark.org/DisplayFilters

Sniffing

Question

You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perform a syn scan in your network, and you notice that kiwi syslog is not receiving the alert message from snort. You decide to run wireshark in the snort machine to check if the messages are going to the kiwi syslog machine. What wireshark filter will show the connections from the snort machine to kiwi syslog machine?

Options

  • Atcp.dstport==514 && ip.dst==192.168.0.150
  • Btcp.srcport==514 && ip.src==192.168.0.99
  • Ctcp.dstport==514 && ip.dst==192.168.0.0/16
  • Dtcp.srcport==514 && ip.src==192.168.150

How the community answered

(34 responses)
  • A
    71% (24)
  • B
    15% (5)
  • C
    9% (3)
  • D
    6% (2)

Explanation

We need to configure destination port at destination ip. The destination ip is 192.168.0.150, where the kiwi syslog is installed. https://wiki.wireshark.org/DisplayFilters

Topics

#Wireshark filters#syslog#network monitoring#packet analysis

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice