nerdexam
GIAC

GCIA · Question #108

Which of the following limits the number of packets seen by tcpdump?

The correct answer is C. BPF-based filter. tcpdump relies on Berkeley Packet Filter (BPF) expressions evaluated in the kernel to limit which packets are captured and passed to user space.

Packet Analysis with Wireshark & Command Line Tools

Question

Which of the following limits the number of packets seen by tcpdump?

Options

  • ASender filtering
  • BIFilters
  • CBPF-based filter
  • DRecipient filtering

How the community answered

(39 responses)
  • A
    5% (2)
  • B
    5% (2)
  • C
    74% (29)
  • D
    15% (6)

Why each option

tcpdump relies on Berkeley Packet Filter (BPF) expressions evaluated in the kernel to limit which packets are captured and passed to user space.

ASender filtering

Sender filtering is not a defined tcpdump construct; source-based filtering in tcpdump is expressed via BPF syntax (e.g., 'src host'), not a separate named feature.

BIFilters

IFilters are a Microsoft Windows interface used by search indexing engines to parse file formats and have no relationship to network packet capture or tcpdump.

CBPF-based filterCorrect

BPF (Berkeley Packet Filter) is the native kernel-level filtering mechanism built into tcpdump; users supply filter expressions (such as 'host 10.0.0.1' or 'port 80') that are compiled into BPF bytecode and executed in the kernel before packets reach user space, directly controlling the number and type of packets tcpdump sees and reducing capture overhead.

DRecipient filtering

Recipient filtering is not a tcpdump feature; destination-based packet selection in tcpdump is handled through BPF filter expressions such as 'dst host'.

Concept tested: Berkeley Packet Filter (BPF) packet filtering in tcpdump

Source: https://www.tcpdump.org/manpages/tcpdump.1.html

Topics

#BPF filter#tcpdump#packet filtering#network capture

Community Discussion

No community discussion yet for this question.

Full GCIA Practice