nerdexam
GIAC

GCIA · Question #115

Which of the following commands prints out the headers of packets regarding the boolean expression?

The correct answer is A. tcpdump. tcpdump is the standard command-line packet analyzer that captures live network traffic and prints packet headers filtered by a boolean expression.

Packet Analysis with Wireshark & Command Line Tools

Question

Which of the following commands prints out the headers of packets regarding the boolean expression?

Options

  • Atcpdump
  • Bvmstat
  • Ciftop
  • Diostat

How the community answered

(44 responses)
  • A
    75% (33)
  • B
    16% (7)
  • C
    7% (3)
  • D
    2% (1)

Why each option

tcpdump is the standard command-line packet analyzer that captures live network traffic and prints packet headers filtered by a boolean expression.

AtcpdumpCorrect

tcpdump captures packets on a specified network interface and outputs their headers - source/destination IP, ports, protocol flags, and sequence numbers - to standard output based on a boolean filter expression using operators such as 'and', 'or', and 'not'. It operates at the packet level by using the libpcap library to read raw frames, making it the definitive tool for low-level network inspection and troubleshooting.

Bvmstat

vmstat reports virtual memory, process scheduling, and CPU statistics for the operating system - it has no capability to capture or display network packet headers.

Ciftop

iftop displays real-time network bandwidth consumption per host pair on an interface - it does not capture packet headers or support boolean filter expressions.

Diostat

iostat reports CPU utilization and disk I/O throughput statistics for block devices - it performs no network packet capture or header analysis.

Concept tested: tcpdump packet capture with boolean filter expressions

Source: https://www.tcpdump.org/manpages/tcpdump.1.html

Topics

#tcpdump#packet headers#boolean expression#command line tools

Community Discussion

No community discussion yet for this question.

Full GCIA Practice