GCIA · Question #100
Which of the following commands will you use with the tcpdump command to capture the traffic from a filter stored in a file?
The correct answer is D. tcpdump -F file_name. The tcpdump -F flag reads BPF filter expressions from a specified file instead of parsing them from the command line.
Question
Which of the following commands will you use with the tcpdump command to capture the traffic from a filter stored in a file?
Options
- Atcpdump -A file_name
- Btcpdump -D file_name
- Ctcpdump -X file_name
- Dtcpdump -F file_name
How the community answered
(48 responses)- A4% (2)
- B8% (4)
- C15% (7)
- D73% (35)
Why each option
The tcpdump -F flag reads BPF filter expressions from a specified file instead of parsing them from the command line.
The -A flag prints each captured packet in plain ASCII text to standard output, used for reading human-readable protocol data, and has nothing to do with reading filter files.
The -D flag lists all available network interfaces on the system that tcpdump can capture from, and does not accept a file argument or relate to filtering.
The -X flag prints each packet's data in both hexadecimal and ASCII format, which is used for detailed packet inspection, not for loading filters from a file.
The -F option in tcpdump instructs the tool to read its packet filter expression from the given file, replacing any filter expression provided on the command line. This is useful for complex or reusable filters that would be cumbersome to type inline. The filter file must contain a valid BPF (Berkeley Packet Filter) expression.
Concept tested: tcpdump filter file input with -F flag
Source: https://www.tcpdump.org/manpages/tcpdump.1.html
Topics
Community Discussion
No community discussion yet for this question.