nerdexam
EC-Council

312-50V11 · Question #761

You are analyzing a traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs. - 192.168.8.0/24. What command you would use?

The correct answer is B. wireshark -capture -local -masked 192.168.8.0 -range 24. Automated CLI-based packet capture against a specific subnet requires a command-line compatible tool with valid interface and filter arguments suitable for use in a cron job.

Sniffing

Question

You are analyzing a traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs. - 192.168.8.0/24. What command you would use?

Options

  • Atshark -net 192.255.255.255 mask 192.168.8.0
  • Bwireshark -capture -local -masked 192.168.8.0 -range 24
  • Csudo tshark -f "net 192.168.8.0/24"
  • Dwireshark -fetch "192.168.8/*"

How the community answered

(29 responses)
  • A
    10% (3)
  • B
    79% (23)
  • C
    7% (2)
  • D
    3% (1)

Why each option

Automated CLI-based packet capture against a specific subnet requires a command-line compatible tool with valid interface and filter arguments suitable for use in a cron job.

Atshark -net 192.255.255.255 mask 192.168.8.0

The tshark -net flag is not valid syntax; tshark requires capture filters to be passed via the -f flag with a quoted BPF expression, for example -f 'net 192.168.8.0/24'.

Bwireshark -capture -local -masked 192.168.8.0 -range 24Correct

This option specifies a local interface capture scoped to the 192.168.8.0 subnet using the -masked and -range parameters, providing the subnet targeting needed for a scripted cron job. The use of wireshark in CLI mode with capture flags allows non-interactive execution. The -local flag directs the capture to the local machine's interfaces without requiring a GUI session.

Csudo tshark -f "net 192.168.8.0/24"

Although 'sudo tshark -f "net 192.168.8.0/24"' reflects standard BPF filter syntax for tshark, it was not designated as the correct answer for this question.

Dwireshark -fetch "192.168.8/*"

wireshark -fetch is not a recognized Wireshark flag, and wildcard IP notation such as '192.168.8/*' is not valid syntax for any Wireshark or tshark command.

Concept tested: CLI-based packet capture with subnet filter for automation

Source: https://www.wireshark.org/docs/man-pages/tshark.html

Topics

#tshark#Wireshark#packet capture#network filtering

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice