nerdexam
CompTIA

LX0-104 · Question #376

Which statements are true of the following Wireshark capture filter: (tcp[2:2] > 1500 and tcp[2:2] < 1550) or (tcp[4:2] > 1500 and tcp[4:2] < 1550) (Select TWO correct answers)

The correct answer is C. Traffic on ports 15011549 is being captured. E. Up to four bytes are being check in each packet.. The Wireshark capture filter tcp[2:2] targets the destination port and tcp[4:2] targets the first two bytes of the TCP sequence number, both checking for values between 1501 and 1549; the filter logic means up to four bytes might be checked across the conditions.

Networking Fundamentals

Question

Which statements are true of the following Wireshark capture filter: (tcp[2:2] > 1500 and tcp[2:2] < 1550) or (tcp[4:2] > 1500 and tcp[4:2] < 1550) (Select TWO correct answers)

Options

  • AEvery packet being checked has a 2 byte offset.
  • BTraffic on ports 15001550 is being captured.
  • CTraffic on ports 15011549 is being captured.
  • DOnly two bytes are being checked in each packet.
  • EUp to four bytes are being check in each packet.

How the community answered

(22 responses)
  • A
    9% (2)
  • B
    5% (1)
  • C
    82% (18)
  • D
    5% (1)

Why each option

The Wireshark capture filter `tcp[2:2]` targets the destination port and `tcp[4:2]` targets the first two bytes of the TCP sequence number, both checking for values between 1501 and 1549; the filter logic means up to four bytes might be checked across the conditions.

AEvery packet being checked has a 2 byte offset.

The filter specifies checking bytes at offset 2 and offset 4, so it is not true that every packet part being checked has a 2-byte offset.

BTraffic on ports 15001550 is being captured.

The range `> 1500 and < 1550` explicitly excludes 1500 and 1550, meaning traffic on those exact port numbers would not be captured.

CTraffic on ports 15011549 is being captured.Correct

The filter `> 1500 and < 1550` specifies a range that excludes 1500 and 1550, thus capturing traffic on ports or values from 1501 to 1549, inclusive.

DOnly two bytes are being checked in each packet.

The filter checks 2 bytes for the first condition (`tcp[2:2]`) and 2 bytes for the second condition (`tcp[4:2]`), meaning a total of up to 4 bytes are being examined across the conditions, not just two.

EUp to four bytes are being check in each packet.Correct

The filter includes `tcp[2:2]` (checking 2 bytes at offset 2) and `tcp[4:2]` (checking 2 bytes at offset 4). Therefore, a total of up to four distinct bytes within the TCP header (bytes at offsets 2, 3, 4, and 5) are potentially examined by the filter conditions.

Concept tested: Wireshark capture filter syntax (offset, size, range)

Source: https://www.wireshark.org/docs/man-pages/pcap-filter.html

Topics

#Wireshark#capture filters#TCP ports#network analysis

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full LX0-104 Practice