An analyst will capture traffic from an air-gapped network that does not use DNS. The analyst is looking for unencrypted Syslog data being transmitted. Which of the following is most efficient for…

The correct answer is B. tcpdump -nnvvX -i eth0 port 6514. When using tcpdump, a -n switch will tell the tool to not resolve hostnames; as this network makes no use of DNS this is efficient. The -vv switch increases the tools output verbosity. The -s0 increases the snaplength to "all" rather than the default of 96 bytes. The -nnvvX…

Enterprise Network Security and Network Services Security

Question

An analyst will capture traffic from an air-gapped network that does not use DNS. The analyst is looking for unencrypted Syslog data being transmitted. Which of the following is most efficient for this purpose?

Options

Atcpdump -s0 -i eth0 port 514
Btcpdump -nnvvX -i eth0 port 6514
Ctcpdump -nX -i eth0 port 514
Dtcpdump -vv -i eth0 port 6514

How the community answered

(35 responses)

A
9% (3)
B
74% (26)
C
14% (5)
D
3% (1)

Explanation

When using tcpdump, a -n switch will tell the tool to not resolve hostnames; as this network makes no use of DNS this is efficient. The -vv switch increases the tools output verbosity. The -s0 increases the snaplength to "all" rather than the default of 96 bytes. The -nnvvX would make sense here except that the port in the filter is 6514 which is the default port for encrypted Syslog

Topics

#tcpdump#Syslog#packet capture#network traffic analysis

Community Discussion

No community discussion yet for this question.

Full GCED Practice