200-201 Question 98
Single answerYou are a junior security analyst investigating unusual network activity. Your team lead asks you to use tcpdump to capture traffic on the 'eth0' interface and filter only HTTP traffic (port 80). Which of the following tcpdump commands would achieve this?
- A
tcpdump -i eth0 port 80
- B
tcpdump -i eth0 tcp port 80
- C
tcpdump -i eth0 udp port 80
- D
tcpdump -p eth0 port 80
Show answer and explanation
Correct answer: B
Explanation
The correct command to capture HTTP traffic with tcpdump on the 'eth0' interface is 'tcpdump -i eth0 tcp port 80'. The '-i eth0' argument specifies the network interface, 'tcp' ensures the capture is filtered to TCP traffic, and 'port 80' restricts the capture to HTTP traffic, which operates on port 80. Explicitly specifying the protocol (TCP) helps avoid capturing non-HTTP traffic on the same port.
- A. Incorrect.
This command is almost correct but does not explicitly specify the TCP protocol, which is a best practice for filtering specific traffic types.
- B. Correct.
This is the correct command. It specifies the interface (eth0), the protocol (TCP), and the port (80) to capture only HTTP traffic.
- C. Incorrect.
This is incorrect because it specifies the UDP protocol, which is not used by HTTP traffic.
- D. Incorrect.
This is incorrect because the '-p' flag prevents the interface from going into promiscuous mode, and 'tcpdump -p' is not valid for capturing traffic on an interface.