GSEC · Question #344
Open the MATE terminal and use the tcpdump program to read - /pcaps /cass tech.pcap. What is the source port number?
The correct answer is E. 36480. Reading a pcap file with 'tcpdump -r' and examining the output reveals the source port of the captured traffic is 36480.
Question
Open the MATE terminal and use the tcpdump program to read - /pcaps /cass tech.pcap. What is the source port number?
Options
- A878733706
- B123
- C443
- D878732274
- E36480
- F2398730476
- G1432
- H80
- I25
How the community answered
(43 responses)- A2% (1)
- B9% (4)
- C2% (1)
- E79% (34)
- I7% (3)
Why each option
Reading a pcap file with 'tcpdump -r' and examining the output reveals the source port of the captured traffic is 36480.
878733706 exceeds the valid port range of 0-65535 and represents a timestamp or sequence number value, not a port.
123 is the well-known port for NTP and does not appear as the source port in this pcap.
443 is the standard HTTPS port and is not the source port recorded in this packet capture.
878732274 exceeds the maximum valid port number (65535) and is not a port value.
Running 'tcpdump -r /pcaps/cass_tech.pcap' parses and displays each captured packet; the source port field in the packet header is shown in the output as 36480. tcpdump displays TCP/UDP port information in the format source.port > destination.port, allowing direct identification of the source port.
2398730476 exceeds the valid TCP/UDP port range and is not a source port number.
1432 is not the source port value shown in the cass_tech.pcap packet capture output.
80 is the standard HTTP port and does not match the source port field in this pcap file.
25 is the standard SMTP port and does not match the source port visible in this packet capture.
Concept tested: tcpdump pcap file analysis for port identification
Source: https://www.tcpdump.org/manpages/tcpdump.1.html
Topics
Community Discussion
No community discussion yet for this question.