Riverbed
830-01 · Question #376
You are using TCPDumps on the server-side SteelHead to troubleshoot an application connectivity issue. The following filter is used on the TCPDump: (host <client IP> and host <server IP>) or (host…
The correct answer is A. (ip[40:4] = <hex client IP> and ip[44:4] = <hex server IP>). See the full explanation below for the reasoning.
Question
You are using TCPDumps on the server-side SteelHead to troubleshoot an application connectivity issue. The following filter is used on the TCPDump: (host <client IP> and host <server IP>) or (host <server IP> and host <steelheadinpath IP>) or (proto gre and ((ip[40:4] = <hex server IP>) or (ip[44:4] = <hex server IP>))) or ip[44:4] = <hex client IP>) or (ip[40:4] = <hex client IP> and ip[44:4] = <hex server IP>))) or (port 7850) What part of the filter captures the traffic which the interceptor has applied NAT to?
Options
- A(ip[40:4] = <hex client IP> and ip[44:4] = <hex server IP>)
- B(host <server IP> and host <steelhead inpath IP>)
- C(proto gre and ((ip[40:4] = <hex server IP>) and ip[44:4] = <hex client IP>)
- D(host <client IP> and host <server IP>)
How the community answered
(25 responses)- A76% (19)
- B4% (1)
- C8% (2)
- D12% (3)
Community Discussion
No community discussion yet for this question.