XK0-004 · Question #237
A junior systems administrator needs to make a packet capture file that will only capture HTTP protocol data to a file called test.pcap. Which of the following commands would allow the administrator…
The correct answer is D. tcpdump -i eth0 port 80 -w test.pcap. tcpdump with the -w flag writes captured packets to a file, while the port 80 filter restricts the capture to HTTP traffic.
Question
A junior systems administrator needs to make a packet capture file that will only capture HTTP protocol data to a file called test.pcap. Which of the following commands would allow the administrator to accomplish this task?
Options
- Anetcat -p 80 -w test.pcap
- Btshark -r test.pcap -o http
- Ctcpdump -i eth0 port 80 -r test.pcap
- Dtcpdump -i eth0 port 80 -w test.pcap
How the community answered
(16 responses)- C6% (1)
- D94% (15)
Why each option
tcpdump with the -w flag writes captured packets to a file, while the port 80 filter restricts the capture to HTTP traffic.
netcat is a utility for reading and writing raw TCP/UDP connections and is not a packet capture tool; it cannot produce a .pcap file.
tshark -r reads from an existing pcap file rather than capturing live traffic, so this command would attempt to open test.pcap as input, not create it.
tcpdump -r reads packets from an existing capture file instead of writing to one, which is the opposite of what is required to create test.pcap.
tcpdump -i eth0 specifies the network interface to listen on, port 80 applies a BPF filter that captures only packets matching HTTP traffic, and -w test.pcap writes the raw captured packets to the specified output file, satisfying all requirements of the task.
Concept tested: Capturing HTTP traffic to a file with tcpdump
Source: https://www.tcpdump.org/manpages/tcpdump.1.html
Topics
Community Discussion
No community discussion yet for this question.