nerdexam
Linux_Foundation

LFCS · Question #376

Which statements are true of the following Wireshark capture filter: (tcp[2:2] > 1500 and tcp[2:2] < 1550) or (tcp[4:2] > 1500 and tcp[4:2] < 1550) (Select TWO correct answers)

The correct answer is C. Traffic on ports 15011549 is being captured. E. Up to four bytes are being check in each packet. This Wireshark capture filter targets TCP traffic where either the source or destination port falls within the range of 1501 to 1549, and it examines bytes at offsets 2 and 4 within the TCP header.

Submitted by jordan8· Apr 18, 2026Networking

Question

Which statements are true of the following Wireshark capture filter: (tcp[2:2] > 1500 and tcp[2:2] < 1550) or (tcp[4:2] > 1500 and tcp[4:2] < 1550) (Select TWO correct answers)

Options

  • AEvery packet being checked has a 2 byte offset.
  • BTraffic on ports 15001550 is being captured.
  • CTraffic on ports 15011549 is being captured.
  • DOnly two bytes are being checked in each packet.
  • EUp to four bytes are being check in each packet.

How the community answered

(39 responses)
  • A
    8% (3)
  • B
    3% (1)
  • C
    85% (33)
  • D
    5% (2)

Why each option

This Wireshark capture filter targets TCP traffic where either the source or destination port falls within the range of 1501 to 1549, and it examines bytes at offsets 2 and 4 within the TCP header.

AEvery packet being checked has a 2 byte offset.

The filter specifies checking bytes at offset 2 (`tcp[2:2]`) AND offset 4 (`tcp[4:2]`), not just offset 2.

BTraffic on ports 15001550 is being captured.

The range `> 1500 and < 1550` is exclusive, meaning it does not include 1500 or 1550, so traffic on ports 1501-1549 is captured, not 1500-1550.

CTraffic on ports 15011549 is being captured.Correct

The filter `> 1500 and < 1550` defines an exclusive range, meaning it captures values greater than 1500 and less than 1550. This translates to the integer range from 1501 through 1549, which applies to TCP source or destination ports since `tcp[2:2]` is the source port and `tcp[4:2]` is the destination port.

DOnly two bytes are being checked in each packet.

The filter checks 2 bytes at offset 2, and another 2 bytes at offset 4, meaning a total of 4 bytes are being evaluated across two different locations, not just 'only two bytes'.

EUp to four bytes are being check in each packet.Correct

The filter expression `tcp[2:2]` checks 2 bytes at offset 2 within the TCP header, and `tcp[4:2]` checks 2 bytes at offset 4 within the TCP header. The maximum offset referenced in the filter is 4 bytes, so bytes are checked up to this position.

Concept tested: Wireshark capture filter syntax (byte offsets and ranges)

Source: https://www.wireshark.org/docs/wsug_html_chunked/ChCapFilterSyntax.html

Topics

#Wireshark#Capture Filters#TCP Header#Packet Filtering

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full LFCS Practice