312-50V13 · Question #182
You are analysing traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs - 192.168.8.0/24. What command you would use?
The correct answer is D. sudo tshark -f''net 192 .68.8.0/24''. To capture network traffic for the 192.168.8.0/24 subnet using a command-line tool suitable for cron jobs, the tshark utility with a capture filter specifying the network is the correct command.
Question
Options
- Awireshark --fetch ''192.168.8*''
- Bwireshark --capture --local masked 192.168.8.0 ---range 24
- Ctshark -net 192.255.255.255 mask 192.168.8.0
- Dsudo tshark -f''net 192 .68.8.0/24''
How the community answered
(27 responses)- A4% (1)
- B19% (5)
- C7% (2)
- D70% (19)
Why each option
To capture network traffic for the 192.168.8.0/24 subnet using a command-line tool suitable for cron jobs, the `tshark` utility with a capture filter specifying the network is the correct command.
`wireshark` is the GUI application, not typically used for cron jobs, and `--fetch` with a wildcard IP is not the correct syntax for a capture filter.
This syntax is entirely incorrect for `wireshark` or `tshark` capture filters; options like `--local masked` or `---range` do not exist for specifying network ranges in this manner.
The `-net` option doesn't exist for `tshark` to define a capture filter. While `net` is part of a capture filter expression, it must be used with `-f` and the filter syntax provided is incorrect.
`tshark` is the command-line equivalent of Wireshark, making it suitable for automation in cron jobs as it doesn't require a graphical interface. The `sudo` command is often necessary to grant `tshark` the elevated privileges required for packet capture on network interfaces, and `-f 'net 192.168.8.0/24'` correctly applies a capture filter to only record traffic originating from or destined to the specified subnet.
Concept tested: tshark capture filters for specific subnets
Source: https://www.wireshark.org/docs/man-pages/tshark.html
Topics
Community Discussion
No community discussion yet for this question.