nerdexam
GIAC

GCIH · Question #203

Windump is a Windows port of the famous TCPDump packet sniffer available on a variety of platforms. In order to use this tool on the Windows platform a user must install a packet capture library…

The correct answer is C. WinPCap. WinDump, the Windows port of tcpdump, requires WinPCap to capture raw network packets because Windows does not natively expose a low-level packet capture interface to user-space applications.

Reconnaissance, Scanning, and Enumeration

Question

Windump is a Windows port of the famous TCPDump packet sniffer available on a variety of platforms. In order to use this tool on the Windows platform a user must install a packet capture library. What is the name of this library?

Options

  • APCAP
  • BSysPCap
  • CWinPCap
  • Dlibpcap

How the community answered

(49 responses)
  • B
    2% (1)
  • C
    96% (47)
  • D
    2% (1)

Why each option

WinDump, the Windows port of tcpdump, requires WinPCap to capture raw network packets because Windows does not natively expose a low-level packet capture interface to user-space applications.

APCAP

PCAP is the generic file format and concept name for packet capture, not the name of the installable Windows library required by WinDump.

BSysPCap

SysPCap does not exist as a real packet capture library; no such tool is part of the standard Windows or network security toolchain.

CWinPCapCorrect

WinPCap (Windows Packet Capture) is the Windows-specific library that installs a kernel-level packet filter driver and exposes a user-level API for capturing raw network frames. WinDump depends entirely on WinPCap to access the network adapter at a low level, mirroring the role that libpcap plays on Unix and Linux systems.

Dlibpcap

libpcap is the packet capture library used on Unix and Linux platforms; the Windows-specific equivalent required by WinDump is WinPCap, not libpcap.

Concept tested: WinDump Windows packet capture library dependency WinPCap

Source: https://www.winpcap.org/

Topics

#WinPCap#packet capture#Windump#TCPDump

Community Discussion

No community discussion yet for this question.

Full GCIH Practice