PCNSE Question #832: Real Exam Question with Answer & Explanation

Question

While troubleshooting an issue, a firewall administrator performs a packet capture with a specific filter. The administrator sees drops for packets with a source IP address of 10.1.1.1. How can the administrator further investigate these packet drops by looking at the global counters for this packet capture filter?

Options

• A> show counter global filter packet-filter yes delta yes
• B> show counter global filter severity drop
• C> debug dataplane packet-diag set capture stage drop
• D> show counter global filter delta yes I match 10.1.1.1

Explanation

Once a packet capture filter has been configured (e.g., matching source IP 10.1.1.1), the administrator can view the global drop counters relevant to that filter using: show counter global filter delta yes | match 10.1.1.1. The delta yes flag shows only counter increments since the last check, making it easier to isolate active drops. The pipe with match filters the output to lines associated with the specific traffic. Note: Option A (show counter global filter packet-filter yes delta yes) is also a valid approach and is actually the canonical command for applying a configured packet-filter to global counter output; it is commonly used in practice alongside option D.

No community discussion yet for this question.