nerdexam
GIAC

GCIH · Question #733

What tcpdump parameter was used to produce the output on lines 2 and 3 shown below?

The correct answer is C. -A. The tcpdump -A flag prints each captured packet's payload in ASCII, producing human-readable content output like the text visible on lines 2 and 3.

Reconnaissance, Scanning, and Enumeration

Question

What tcpdump parameter was used to produce the output on lines 2 and 3 shown below?

Exhibit

GCIH question #733 exhibit

Options

  • A-n
  • B-r
  • C-A
  • D-i

How the community answered

(38 responses)
  • A
    3% (1)
  • B
    3% (1)
  • C
    95% (36)

Why each option

The tcpdump -A flag prints each captured packet's payload in ASCII, producing human-readable content output like the text visible on lines 2 and 3.

A-n

The -n flag suppresses hostname and port name resolution, displaying raw IP addresses and port numbers instead of DNS names - it does not alter how packet payload data is rendered.

B-r

The -r flag reads packet data from a previously saved .pcap file rather than a live interface, affecting the data source but not the display format of packet contents.

C-ACorrect

The -A parameter instructs tcpdump to print each packet in ASCII format, rendering the packet payload as readable text. This is commonly used to inspect plain-text protocol traffic such as HTTP headers and bodies, which would produce the type of readable multi-line output described in the question.

D-i

The -i flag specifies which network interface to capture traffic from (e.g., -i eth0) and has no effect on how the captured packet data is formatted or displayed.

Concept tested: tcpdump -A flag for ASCII packet payload display

Source: https://www.tcpdump.org/manpages/tcpdump.1.html

Topics

#tcpdump#ASCII output#-A flag#packet capture

Community Discussion

No community discussion yet for this question.

Full GCIH Practice