GCIH · Question #725
Which of the following is an example of a Berkeley Packet Filter (BPF) expression?
The correct answer is B. 'not src host 10.1.12.52'. Berkeley Packet Filter (BPF) expressions use a specific syntax with keywords like host, port, src, dst, and logical operators, as used in tools like tcpdump.
Question
Which of the following is an example of a Berkeley Packet Filter (BPF) expression?
Options
- A[\w._%+-]
- B'not src host 10.1.12.52'
- Cicmp -j DROP
- D{$_.Enabled -eq $True}
How the community answered
(39 responses)- A5% (2)
- B90% (35)
- C3% (1)
- D3% (1)
Why each option
Berkeley Packet Filter (BPF) expressions use a specific syntax with keywords like host, port, src, dst, and logical operators, as used in tools like tcpdump.
[\w._%+-] is a regular expression pattern used for string matching, not a BPF network filter expression.
The expression 'not src host 10.1.12.52' follows valid BPF syntax, using the logical operator 'not', the qualifier 'src', the primitive 'host', and an IP address. BPF expressions are used in packet capture tools such as tcpdump and Wireshark to filter network traffic at the kernel level. This syntax is the defining characteristic that distinguishes BPF from other filtering languages.
icmp -j DROP is iptables syntax used for Linux netfilter firewall rules, not a BPF expression.
{{$_.Enabled -eq $True}} is PowerShell object filtering syntax, not a BPF packet filter expression.
Concept tested: Berkeley Packet Filter syntax and usage
Source: https://www.tcpdump.org/manpages/pcap-filter.7.html
Topics
Community Discussion
No community discussion yet for this question.