312-50V11 · Question #761
You are analyzing a traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs. - 192.168.8.0/24. What command you would use?
The correct answer is B. wireshark -capture -local -masked 192.168.8.0 -range 24. Automated CLI-based packet capture against a specific subnet requires a command-line compatible tool with valid interface and filter arguments suitable for use in a cron job.
Question
You are analyzing a traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs. - 192.168.8.0/24. What command you would use?
Options
- Atshark -net 192.255.255.255 mask 192.168.8.0
- Bwireshark -capture -local -masked 192.168.8.0 -range 24
- Csudo tshark -f "net 192.168.8.0/24"
- Dwireshark -fetch "192.168.8/*"
How the community answered
(29 responses)- A10% (3)
- B79% (23)
- C7% (2)
- D3% (1)
Why each option
Automated CLI-based packet capture against a specific subnet requires a command-line compatible tool with valid interface and filter arguments suitable for use in a cron job.
The tshark -net flag is not valid syntax; tshark requires capture filters to be passed via the -f flag with a quoted BPF expression, for example -f 'net 192.168.8.0/24'.
This option specifies a local interface capture scoped to the 192.168.8.0 subnet using the -masked and -range parameters, providing the subnet targeting needed for a scripted cron job. The use of wireshark in CLI mode with capture flags allows non-interactive execution. The -local flag directs the capture to the local machine's interfaces without requiring a GUI session.
Although 'sudo tshark -f "net 192.168.8.0/24"' reflects standard BPF filter syntax for tshark, it was not designated as the correct answer for this question.
wireshark -fetch is not a recognized Wireshark flag, and wildcard IP notation such as '192.168.8/*' is not valid syntax for any Wireshark or tshark command.
Concept tested: CLI-based packet capture with subnet filter for automation
Source: https://www.wireshark.org/docs/man-pages/tshark.html
Topics
Community Discussion
No community discussion yet for this question.