nerdexam
GIAC

GCIA · Question #100

Which of the following commands will you use with the tcpdump command to capture the traffic from a filter stored in a file?

The correct answer is D. tcpdump -F file_name. The tcpdump -F flag reads BPF filter expressions from a specified file instead of parsing them from the command line.

Packet Analysis with Wireshark & Command Line Tools

Question

Which of the following commands will you use with the tcpdump command to capture the traffic from a filter stored in a file?

Options

  • Atcpdump -A file_name
  • Btcpdump -D file_name
  • Ctcpdump -X file_name
  • Dtcpdump -F file_name

How the community answered

(48 responses)
  • A
    4% (2)
  • B
    8% (4)
  • C
    15% (7)
  • D
    73% (35)

Why each option

The tcpdump -F flag reads BPF filter expressions from a specified file instead of parsing them from the command line.

Atcpdump -A file_name

The -A flag prints each captured packet in plain ASCII text to standard output, used for reading human-readable protocol data, and has nothing to do with reading filter files.

Btcpdump -D file_name

The -D flag lists all available network interfaces on the system that tcpdump can capture from, and does not accept a file argument or relate to filtering.

Ctcpdump -X file_name

The -X flag prints each packet's data in both hexadecimal and ASCII format, which is used for detailed packet inspection, not for loading filters from a file.

Dtcpdump -F file_nameCorrect

The -F option in tcpdump instructs the tool to read its packet filter expression from the given file, replacing any filter expression provided on the command line. This is useful for complex or reusable filters that would be cumbersome to type inline. The filter file must contain a valid BPF (Berkeley Packet Filter) expression.

Concept tested: tcpdump filter file input with -F flag

Source: https://www.tcpdump.org/manpages/tcpdump.1.html

Topics

#tcpdump#BPF filter#packet capture#command line tools

Community Discussion

No community discussion yet for this question.

Full GCIA Practice