312-50V9 · Question #321
As an Ethical Hacker you are capturing traffic from your customer network with Wireshark and you need to find and verify just SMTP traffic. What command in Wireshark will help you to find this kind of
The correct answer is B. tcp.port eq 25. Wireshark uses display filter syntax where 'tcp.port eq 25' correctly isolates SMTP traffic by filtering on TCP port 25.
Question
As an Ethical Hacker you are capturing traffic from your customer network with Wireshark and you need to find and verify just SMTP traffic. What command in Wireshark will help you to find this kind of traffic?
Options
- Arequest smtp 25
- Btcp.port eq 25
- Csmtp port
- Dtcp.contains port 25
How the community answered
(38 responses)- A3% (1)
- B89% (34)
- C5% (2)
- D3% (1)
Why each option
Wireshark uses display filter syntax where 'tcp.port eq 25' correctly isolates SMTP traffic by filtering on TCP port 25.
'request smtp 25' is not valid Wireshark display filter syntax and will produce a filter parse error.
In Wireshark, 'tcp.port eq 25' is valid display filter syntax that matches any TCP packet where either the source or destination port is 25, which is the standard well-known port assigned to SMTP. Wireshark display filters follow a strict field-name operator value format, and tcp.port is a recognized protocol field. This filter will capture both client-to-server and server-to-client SMTP traffic in a single expression.
'smtp port' is not recognized Wireshark display filter syntax and does not conform to the field operator value format.
'tcp.contains' checks payload byte sequences, not port numbers, making this syntactically and semantically incorrect for port-based filtering.
Concept tested: Wireshark display filter syntax for protocol port filtering
Source: https://wiki.wireshark.org/DisplayFilters
Topics
Community Discussion
No community discussion yet for this question.