nerdexam
GIAC

GCIH · Question #725

Which of the following is an example of a Berkeley Packet Filter (BPF) expression?

The correct answer is B. 'not src host 10.1.12.52'. Berkeley Packet Filter (BPF) expressions use a specific syntax with keywords like host, port, src, dst, and logical operators, as used in tools like tcpdump.

Reconnaissance, Scanning, and Enumeration

Question

Which of the following is an example of a Berkeley Packet Filter (BPF) expression?

Options

  • A[\w._%+-]
  • B'not src host 10.1.12.52'
  • Cicmp -j DROP
  • D{$_.Enabled -eq $True}

How the community answered

(39 responses)
  • A
    5% (2)
  • B
    90% (35)
  • C
    3% (1)
  • D
    3% (1)

Why each option

Berkeley Packet Filter (BPF) expressions use a specific syntax with keywords like host, port, src, dst, and logical operators, as used in tools like tcpdump.

A[\w._%+-]

[\w._%+-] is a regular expression pattern used for string matching, not a BPF network filter expression.

B'not src host 10.1.12.52'Correct

The expression 'not src host 10.1.12.52' follows valid BPF syntax, using the logical operator 'not', the qualifier 'src', the primitive 'host', and an IP address. BPF expressions are used in packet capture tools such as tcpdump and Wireshark to filter network traffic at the kernel level. This syntax is the defining characteristic that distinguishes BPF from other filtering languages.

Cicmp -j DROP

icmp -j DROP is iptables syntax used for Linux netfilter firewall rules, not a BPF expression.

D{$_.Enabled -eq $True}

{{$_.Enabled -eq $True}} is PowerShell object filtering syntax, not a BPF packet filter expression.

Concept tested: Berkeley Packet Filter syntax and usage

Source: https://www.tcpdump.org/manpages/pcap-filter.7.html

Topics

#BPF#packet filtering#tcpdump#network capture syntax

Community Discussion

No community discussion yet for this question.

Full GCIH Practice