200-201 Question 99
Single answerDuring a cybersecurity investigation, you are tasked with capturing and analyzing network traffic on a Linux server using TCPdump. You need to focus on HTTP traffic from a specific IP address (192.168.1.10) and save the output to a file for later analysis. Which of the following TCPdump commands would achieve this?
- A
tcpdump -i eth0 host 192.168.1.10 and port 80 -w capture.pcap
- B
tcpdump -i eth0 src 192.168.1.10 -w capture.log
- C
tcpdump -i eth0 dst 192.168.1.10 and tcp -w capture.txt
- D
tcpdump -i eth0 port 443 and host 192.168.1.10 -w capture.pcap
Show answer and explanation
Correct answer: A
Explanation
The correct command must capture HTTP traffic (port 80) related to the specified IP address (192.168.1.10) on the specified interface (eth0) and save it in a valid pcap file format. Option 1 meets all these criteria, making it the correct choice.
- A. Correct.
Correct. This command captures traffic on interface eth0, filters for packets involving the specified IP address (192.168.1.10) on port 80 (HTTP traffic), and writes the output to a file (capture.pcap) for later analysis.
- B. Incorrect.
Incorrect. While this command captures traffic from the specified IP address, it does not filter specifically for HTTP traffic (port 80), and the output file extension (.log) is not typically used for pcap files.
- C. Incorrect.
Incorrect. This command captures only traffic destined for the specified IP address and does not filter for HTTP traffic. Additionally, the output file extension (.txt) is not standard for pcap files.
- D. Incorrect.
Incorrect. This command captures HTTPS traffic (port 443) instead of HTTP traffic (port 80), which does not meet the requirement of focusing on HTTP traffic.