GCIH · Question #706
Which tcpdump command will open the capture.dmp pcap file and display the ASCII output of traffic going to and from 192.168.122.12?
The correct answer is C. tcpdump -r capture.dmp -A host 192.168.122.12. Reading a saved pcap file with tcpdump requires the -r flag, while -A outputs ASCII and the 'host' filter captures bidirectional traffic for the specified IP.
Question
Which tcpdump command will open the capture.dmp pcap file and display the ASCII output of traffic going to and from 192.168.122.12?
Options
- Atcpdump -r capture.dmp -ASC src 192.168.122.12
- Btcpdump -i capture.dmp -ASC 192.168.122.12
- Ctcpdump -r capture.dmp -A host 192.168.122.12
- Dtcpdump -i capture.dmp -A host 192.168.122.12
How the community answered
(24 responses)- A4% (1)
- B8% (2)
- C71% (17)
- D17% (4)
Why each option
Reading a saved pcap file with tcpdump requires the -r flag, while -A outputs ASCII and the 'host' filter captures bidirectional traffic for the specified IP.
Although -r correctly reads from a file, the 'src' filter only matches traffic originating from the specified IP and misses traffic destined to it.
The -i flag designates a live capture interface, not a file path - specifying a pcap filename with -i will fail because it is not a valid interface name.
The -r flag tells tcpdump to read packets from a saved capture file rather than a live network interface. The -A flag prints each packet's payload in ASCII, which is useful for inspecting plain-text protocols. Using 'host 192.168.122.12' as the BPF filter matches all packets both sourced from and destined to that address, satisfying the bidirectional requirement.
Using -i instead of -r attempts to treat the capture file as a live interface name, which is incorrect syntax for reading saved pcap captures.
Concept tested: tcpdump read-file flag and bidirectional host filter
Source: https://www.tcpdump.org/manpages/tcpdump.1.html
Topics
Community Discussion
No community discussion yet for this question.