nerdexam
EC-Council

312-50V9 · Question #321

As an Ethical Hacker you are capturing traffic from your customer network with Wireshark and you need to find and verify just SMTP traffic. What command in Wireshark will help you to find this kind of

The correct answer is B. tcp.port eq 25. Wireshark uses display filter syntax where 'tcp.port eq 25' correctly isolates SMTP traffic by filtering on TCP port 25.

Sniffing

Question

As an Ethical Hacker you are capturing traffic from your customer network with Wireshark and you need to find and verify just SMTP traffic. What command in Wireshark will help you to find this kind of traffic?

Options

  • Arequest smtp 25
  • Btcp.port eq 25
  • Csmtp port
  • Dtcp.contains port 25

How the community answered

(38 responses)
  • A
    3% (1)
  • B
    89% (34)
  • C
    5% (2)
  • D
    3% (1)

Why each option

Wireshark uses display filter syntax where 'tcp.port eq 25' correctly isolates SMTP traffic by filtering on TCP port 25.

Arequest smtp 25

'request smtp 25' is not valid Wireshark display filter syntax and will produce a filter parse error.

Btcp.port eq 25Correct

In Wireshark, 'tcp.port eq 25' is valid display filter syntax that matches any TCP packet where either the source or destination port is 25, which is the standard well-known port assigned to SMTP. Wireshark display filters follow a strict field-name operator value format, and tcp.port is a recognized protocol field. This filter will capture both client-to-server and server-to-client SMTP traffic in a single expression.

Csmtp port

'smtp port' is not recognized Wireshark display filter syntax and does not conform to the field operator value format.

Dtcp.contains port 25

'tcp.contains' checks payload byte sequences, not port numbers, making this syntactically and semantically incorrect for port-based filtering.

Concept tested: Wireshark display filter syntax for protocol port filtering

Source: https://wiki.wireshark.org/DisplayFilters

Topics

#Wireshark#SMTP#packet filtering#port 25

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice