300-215 Question 187
Single answerYou are investigating a potential data exfiltration incident in your network. Using NetFlow data, you identify a host sending large volumes of traffic to an unfamiliar external IP address on port 22 (SSH). To confirm the nature of this traffic, you capture packets from the host and load them into Wireshark. Which display filter would you use in Wireshark to isolate this suspicious activity?
- A
tcp.port == 22 and ip.dst == <suspicious_IP>
- B
udp.port == 22 and ip.src == <host_IP>
- C
tcp.port == 22 and ip.src == <host_IP>
- D
tcp.flags == 0x02 and ip.dst == <suspicious_IP>
Show answer and explanation
Correct answer: A
Explanation
To analyze network traffic associated with malicious activities, you need a precise filter that matches the scenario. The correct filter (tcp.port == 22 and ip.dst == <suspicious_IP>) isolates SSH traffic destined for the suspicious external IP, aligning with the NetFlow observation and focusing the analysis on the relevant packets.
- A. Correct.
This filter correctly isolates traffic using TCP port 22 (SSH) from the suspicious host to the external IP. It matches the scenario and is the correct choice.
- B. Incorrect.
This filter incorrectly uses UDP, which is not applicable for SSH traffic as SSH operates over TCP.
- C. Incorrect.
This filter isolates traffic using TCP port 22 but filters based on the source IP of the host. While partially correct, it does not account for the destination IP, making it less precise for this investigation.
- D. Incorrect.
A TCP flag filter (e.g., SYN) is used for analyzing specific TCP handshake stages, not for isolating general SSH traffic. This does not match the goal of identifying exfiltration activity.