nerdexam
GIAC

GSEC · Question #344

Open the MATE terminal and use the tcpdump program to read - /pcaps /cass tech.pcap. What is the source port number?

The correct answer is E. 36480. Reading a pcap file with 'tcpdump -r' and examining the output reveals the source port of the captured traffic is 36480.

Networking and Core Concepts

Question

Open the MATE terminal and use the tcpdump program to read - /pcaps /cass tech.pcap. What is the source port number?

Options

  • A878733706
  • B123
  • C443
  • D878732274
  • E36480
  • F2398730476
  • G1432
  • H80
  • I25

How the community answered

(43 responses)
  • A
    2% (1)
  • B
    9% (4)
  • C
    2% (1)
  • E
    79% (34)
  • I
    7% (3)

Why each option

Reading a pcap file with 'tcpdump -r' and examining the output reveals the source port of the captured traffic is 36480.

A878733706

878733706 exceeds the valid port range of 0-65535 and represents a timestamp or sequence number value, not a port.

B123

123 is the well-known port for NTP and does not appear as the source port in this pcap.

C443

443 is the standard HTTPS port and is not the source port recorded in this packet capture.

D878732274

878732274 exceeds the maximum valid port number (65535) and is not a port value.

E36480Correct

Running 'tcpdump -r /pcaps/cass_tech.pcap' parses and displays each captured packet; the source port field in the packet header is shown in the output as 36480. tcpdump displays TCP/UDP port information in the format source.port > destination.port, allowing direct identification of the source port.

F2398730476

2398730476 exceeds the valid TCP/UDP port range and is not a source port number.

G1432

1432 is not the source port value shown in the cass_tech.pcap packet capture output.

H80

80 is the standard HTTP port and does not match the source port field in this pcap file.

I25

25 is the standard SMTP port and does not match the source port visible in this packet capture.

Concept tested: tcpdump pcap file analysis for port identification

Source: https://www.tcpdump.org/manpages/tcpdump.1.html

Topics

#tcpdump#packet analysis#PCAP#network traffic

Community Discussion

No community discussion yet for this question.

Full GSEC Practice