nerdexam
GIAC

GCIH · Question #698

Which of the following packets saved in the file pingout.pcap would be returned with the following Berkley Packet Filters? tcpdump -nn -r pingout.pcap '榠cmp and (dst host 8.8.8.8)'

The correct answer is D. 08:54:07.424996 IP 192.168.1.14 > 8.8.8.8: ICMP echo request, id 36234, seq 3, length 64. The tcpdump BPF filter 'icmp and (dst host 8.8.8.8)' matches only ICMP packets where the destination IP address is exactly 8.8.8.8.

Reconnaissance, Scanning, and Enumeration

Question

Which of the following packets saved in the file pingout.pcap would be returned with the following Berkley Packet Filters? tcpdump -nn -r pingout.pcap '榠cmp and (dst host 8.8.8.8)'

Options

  • A09:31:00.928389 IP 192.168.1.14.63263 > 8.8.8.8.33595: UDP, length 24
  • B08:54:07.451392 IP 8.8.8.8 > 192.168.1.14: ICMP echo reply, id 36234, seq 3, length 64
  • C09:06:09.085200 IP 192.168.1.14.49655 > 8.8.8.8.22: Flags [S], seq 2144394082, win 65535,
  • D08:54:07.424996 IP 192.168.1.14 > 8.8.8.8: ICMP echo request, id 36234, seq 3, length 64

How the community answered

(37 responses)
  • A
    5% (2)
  • B
    3% (1)
  • C
    11% (4)
  • D
    81% (30)

Why each option

The tcpdump BPF filter 'icmp and (dst host 8.8.8.8)' matches only ICMP packets where the destination IP address is exactly 8.8.8.8.

A09:31:00.928389 IP 192.168.1.14.63263 > 8.8.8.8.33595: UDP, length 24

This packet uses the UDP protocol rather than ICMP, so it fails the 'icmp' portion of the filter regardless of destination.

B08:54:07.451392 IP 8.8.8.8 > 192.168.1.14: ICMP echo reply, id 36234, seq 3, length 64

While this is an ICMP packet, the destination host is 192.168.1.14 rather than 8.8.8.8, failing the 'dst host 8.8.8.8' condition.

C09:06:09.085200 IP 192.168.1.14.49655 > 8.8.8.8.22: Flags [S], seq 2144394082, win 65535,

This packet uses TCP as indicated by the SYN flag, not ICMP, so it fails the protocol portion of the filter.

D08:54:07.424996 IP 192.168.1.14 > 8.8.8.8: ICMP echo request, id 36234, seq 3, length 64Correct

This packet is an ICMP echo request originating from 192.168.1.14 with a destination of 8.8.8.8, satisfying both filter conditions simultaneously - the protocol is ICMP and the destination host is 8.8.8.8. The 'and' operator requires both predicates to be true for a packet to be captured and returned.

Concept tested: tcpdump Berkeley Packet Filter ICMP and destination host filtering

Source: https://www.tcpdump.org/manpages/pcap-filter.7.html

Topics

#tcpdump#BPF filter#ICMP#packet analysis

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice