Capture filters, display filters, TCP handshake and flags, following streams, common protocol signatures and troubleshooting patterns.
34 cards · basic cards · AI-written, checked twice. Edit anything.
- What is the basic syntax for a capture filter in tcpdump?
Show answer
protocol [direction] [host/port] [logical operators]- How do you capture only packets to and from a specific host in tcpdump?
Show answer
host <ip-address>- In tcpdump, what logical operators can you use in capture filters?
Show answer
and, or, not (or &&, ||, !)- What capture filter in tcpdump selects only TCP traffic?
Show answer
tcp- What is the purpose of a display filter in Wireshark?
Show answer
To filter packets after capture without discarding them from the capture file- What Wireshark display filter shows only HTTP protocol traffic?
Show answer
http- How do you filter for only packets with destination IP 10.0.0.5 in Wireshark?
Show answer
ip.dst == 10.0.0.5- What Wireshark display filter shows traffic on TCP port 22?
Show answer
tcp.port == 22- What logical operators are available in Wireshark display filters?
Show answer
and, or, not, xor- How do you exclude DNS traffic from a Wireshark display filter?
Show answer
!dns (or not dns)- What three packets are exchanged in a TCP three-way handshake?
Show answer
SYN, SYN-ACK, ACK- What does the TCP SYN flag indicate?
Show answer
Synchronization of sequence numbers, initiating a new connection- What does the TCP ACK flag indicate?
Show answer
Acknowledgment of received data or sequence numbers- What TCP flag indicates the start of a connection termination?
Show answer
FIN (optionally combined with ACK)- What does the TCP RST flag indicate?
Show answer
Reset, abruptly terminating the connection
FlashKeepers