nerdexam
EC-Council

312-50V13 · Question #182

You are analysing traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs - 192.168.8.0/24. What command you would use?

The correct answer is D. sudo tshark -f''net 192 .68.8.0/24''. To capture network traffic for the 192.168.8.0/24 subnet using a command-line tool suitable for cron jobs, the tshark utility with a capture filter specifying the network is the correct command.

Submitted by chiamaka_o· Mar 6, 2026Sniffing

Question

You are analysing traffic on the network with Wireshark. You want to routinely run a cron job which will run the capture against a specific set of IPs - 192.168.8.0/24. What command you would use?

Options

  • Awireshark --fetch ''192.168.8*''
  • Bwireshark --capture --local masked 192.168.8.0 ---range 24
  • Ctshark -net 192.255.255.255 mask 192.168.8.0
  • Dsudo tshark -f''net 192 .68.8.0/24''

How the community answered

(27 responses)
  • A
    4% (1)
  • B
    19% (5)
  • C
    7% (2)
  • D
    70% (19)

Why each option

To capture network traffic for the 192.168.8.0/24 subnet using a command-line tool suitable for cron jobs, the `tshark` utility with a capture filter specifying the network is the correct command.

Awireshark --fetch ''192.168.8*''

`wireshark` is the GUI application, not typically used for cron jobs, and `--fetch` with a wildcard IP is not the correct syntax for a capture filter.

Bwireshark --capture --local masked 192.168.8.0 ---range 24

This syntax is entirely incorrect for `wireshark` or `tshark` capture filters; options like `--local masked` or `---range` do not exist for specifying network ranges in this manner.

Ctshark -net 192.255.255.255 mask 192.168.8.0

The `-net` option doesn't exist for `tshark` to define a capture filter. While `net` is part of a capture filter expression, it must be used with `-f` and the filter syntax provided is incorrect.

Dsudo tshark -f''net 192 .68.8.0/24''Correct

`tshark` is the command-line equivalent of Wireshark, making it suitable for automation in cron jobs as it doesn't require a graphical interface. The `sudo` command is often necessary to grant `tshark` the elevated privileges required for packet capture on network interfaces, and `-f 'net 192.168.8.0/24'` correctly applies a capture filter to only record traffic originating from or destined to the specified subnet.

Concept tested: tshark capture filters for specific subnets

Source: https://www.wireshark.org/docs/man-pages/tshark.html

Topics

#Tshark#Packet capture#Network analysis#BPF filters

Community Discussion

No community discussion yet for this question.

Full 312-50V13 Practice