nerdexam
EC-Council

312-50V13 · Question #329

Based on the below log, which of the following sentences are true? Mar 1, 2016, 7:33:28 AM 10.240.250.23 ­ 54373 10.249.253.15 ­ 22 tcp_ip

The correct answer is D. Application is SSH and 10.240.250.23 is the client and 10.249.253.15 is the server. Analyzing the log entry Mar 1, 2016, 7:33:28 AM 10.240.250.23 ­ 54373 10.249.253.15 ­ 22 tcp_ip indicates an SSH connection where 10.240.250.23 is the client and 10.249.253.15 is the server.

Submitted by akirajp· Mar 6, 2026Sniffing

Question

Based on the below log, which of the following sentences are true? Mar 1, 2016, 7:33:28 AM 10.240.250.23 ­ 54373 10.249.253.15 ­ 22 tcp_ip

Options

  • AApplication is FTP and 10.240.250.23 is the client and 10.249.253.15 is the server.
  • BApplication is SSH and 10.240.250.23 is the server and 10.249.253.15 is the client.
  • CSSH communications are encrypted; it's impossible to know who is the client or the server.
  • DApplication is SSH and 10.240.250.23 is the client and 10.249.253.15 is the server.

How the community answered

(34 responses)
  • A
    3% (1)
  • B
    6% (2)
  • C
    15% (5)
  • D
    76% (26)

Why each option

Analyzing the log entry `Mar 1, 2016, 7:33:28 AM 10.240.250.23 ­ 54373 10.249.253.15 ­ 22 tcp_ip` indicates an SSH connection where 10.240.250.23 is the client and 10.249.253.15 is the server.

AApplication is FTP and 10.240.250.23 is the client and 10.249.253.15 is the server.

FTP uses ports 20 and 21, not 22, and the client/server roles would be reversed based on typical ephemeral-to-well-known port connections.

BApplication is SSH and 10.240.250.23 is the server and 10.249.253.15 is the client.

While the application is SSH (port 22), the client and server roles are incorrectly identified; the client connects from the ephemeral port.

CSSH communications are encrypted; it's impossible to know who is the client or the server.

Although SSH communications are encrypted, the port number (22) and the client-server port convention allow identification of the application and the roles of the communicating parties.

DApplication is SSH and 10.240.250.23 is the client and 10.249.253.15 is the server.Correct

The log shows a connection to port 22 (`10.249.253.15 - 22`), which is the well-known port for SSH. The originating IP `10.240.250.23` uses a high-numbered ephemeral port (`54373`), indicating it is the client initiating the connection to the server on the well-known port.

Concept tested: Network log analysis, well-known ports, and client/server roles

Topics

#Log analysis#SSH#Port numbers#Client-server model

Community Discussion

No community discussion yet for this question.

Full 312-50V13 Practice