Which packet capture option filters out only SMTP traffic to and from IP address 209.165.201.10?

Question

Options

• Asrc=209.165.201.10proto=smtp
• Bdst=209.165.201.10 and port=25
• Chost 209.165.201.10 and port 25
• Dsrc or dst 209.165.201.10 and proto smtp

• A
  4% (1)
• B
  14% (4)
• C
  79% (22)
• D
  4% (1)

Explanation

Option C uses valid BPF (Berkeley Packet Filter) syntax, which is the standard for packet capture tools like Wireshark and tcpdump. The host keyword matches traffic both to and from the specified IP address, while port 25 correctly identifies SMTP by its well-known port number - together they precisely capture all SMTP traffic involving that host.

Why the distractors fail:

• A is invalid syntax - it uses = assignment-style operators and has no space between filters, which no standard capture tool recognizes.
• B only captures traffic destined for that IP (dst), missing return traffic; it also uses the non-standard = syntax (port=25 should be port 25).
• D attempts the right logic but uses proto smtp which is not valid BPF syntax - SMTP is an application-layer protocol identified by port, not by a protocol primitive; it also lacks parentheses around src or dst, which causes operator precedence issues.

Memory tip: Think of host as shorthand for "either direction" - one word does the job of both src and dst. Pair it with the port number (not the protocol name) and you have a clean, valid capture filter: host = both directions, port = application identity.

No community discussion yet for this question.