GCIA · Question #108
Which of the following limits the number of packets seen by tcpdump?
The correct answer is C. BPF-based filter. tcpdump relies on Berkeley Packet Filter (BPF) expressions evaluated in the kernel to limit which packets are captured and passed to user space.
Question
Which of the following limits the number of packets seen by tcpdump?
Options
- ASender filtering
- BIFilters
- CBPF-based filter
- DRecipient filtering
How the community answered
(39 responses)- A5% (2)
- B5% (2)
- C74% (29)
- D15% (6)
Why each option
tcpdump relies on Berkeley Packet Filter (BPF) expressions evaluated in the kernel to limit which packets are captured and passed to user space.
Sender filtering is not a defined tcpdump construct; source-based filtering in tcpdump is expressed via BPF syntax (e.g., 'src host'), not a separate named feature.
IFilters are a Microsoft Windows interface used by search indexing engines to parse file formats and have no relationship to network packet capture or tcpdump.
BPF (Berkeley Packet Filter) is the native kernel-level filtering mechanism built into tcpdump; users supply filter expressions (such as 'host 10.0.0.1' or 'port 80') that are compiled into BPF bytecode and executed in the kernel before packets reach user space, directly controlling the number and type of packets tcpdump sees and reducing capture overhead.
Recipient filtering is not a tcpdump feature; destination-based packet selection in tcpdump is handled through BPF filter expressions such as 'dst host'.
Concept tested: Berkeley Packet Filter (BPF) packet filtering in tcpdump
Source: https://www.tcpdump.org/manpages/tcpdump.1.html
Topics
Community Discussion
No community discussion yet for this question.