nerdexam
GIAC

GCIH · Question #706

Which tcpdump command will open the capture.dmp pcap file and display the ASCII output of traffic going to and from 192.168.122.12?

The correct answer is C. tcpdump -r capture.dmp -A host 192.168.122.12. Reading a saved pcap file with tcpdump requires the -r flag, while -A outputs ASCII and the 'host' filter captures bidirectional traffic for the specified IP.

Incident Response & Cyber Kill Chain

Question

Which tcpdump command will open the capture.dmp pcap file and display the ASCII output of traffic going to and from 192.168.122.12?

Options

  • Atcpdump -r capture.dmp -ASC src 192.168.122.12
  • Btcpdump -i capture.dmp -ASC 192.168.122.12
  • Ctcpdump -r capture.dmp -A host 192.168.122.12
  • Dtcpdump -i capture.dmp -A host 192.168.122.12

How the community answered

(24 responses)
  • A
    4% (1)
  • B
    8% (2)
  • C
    71% (17)
  • D
    17% (4)

Why each option

Reading a saved pcap file with tcpdump requires the -r flag, while -A outputs ASCII and the 'host' filter captures bidirectional traffic for the specified IP.

Atcpdump -r capture.dmp -ASC src 192.168.122.12

Although -r correctly reads from a file, the 'src' filter only matches traffic originating from the specified IP and misses traffic destined to it.

Btcpdump -i capture.dmp -ASC 192.168.122.12

The -i flag designates a live capture interface, not a file path - specifying a pcap filename with -i will fail because it is not a valid interface name.

Ctcpdump -r capture.dmp -A host 192.168.122.12Correct

The -r flag tells tcpdump to read packets from a saved capture file rather than a live network interface. The -A flag prints each packet's payload in ASCII, which is useful for inspecting plain-text protocols. Using 'host 192.168.122.12' as the BPF filter matches all packets both sourced from and destined to that address, satisfying the bidirectional requirement.

Dtcpdump -i capture.dmp -A host 192.168.122.12

Using -i instead of -r attempts to treat the capture file as a live interface name, which is incorrect syntax for reading saved pcap captures.

Concept tested: tcpdump read-file flag and bidirectional host filter

Source: https://www.tcpdump.org/manpages/tcpdump.1.html

Topics

#tcpdump#packet capture#pcap analysis#network forensics

Community Discussion

No community discussion yet for this question.

Full GCIH Practice