tcpdump Traffic Analysis for Linux Professionals

1. How do you capture traffic between two specific hosts?

Tcpdump host 192.168.1.1 and host 192.168.1.2

Tcpdump 192.168.1.1 or 192.168.1.2

Tcpdump between 192.168.1.1 192.168.1.2

Tcpdump -hosts 192.168.1.1 192.168.1.2

2. Which option writes output to a file in pcap format for later analysis?

-w output.pcap

-o output.pcap

-f output.pcap

-save output.pcap

3. Which command captures traffic from source IP 10.0.0.5 to port 22?

Tcpdump src 10.0.0.5 and dst port 22

Tcpdump from 10.0.0.5 port 22

Tcpdump -s 10.0.0.5 -p 22

Tcpdump 10.0.0.5:22

4. How do you capture ICMP traffic (ping requests and replies)?

Tcpdump icmp

Tcpdump ping

Tcpdump -protocol icmp

Tcpdump type icmp

5. What does the 'not' operator do in a tcpdump filter?

Inverts the filter logic to exclude matching traffic

Disables the filter entirely

Combines multiple filter conditions

Negates only TCP packets

6. Which option displays the payload in hexadecimal and ASCII?

-X

-A

-H

-x

7. What does 'tcpdump -c 100' do?

Captures exactly 100 packets then stops

Captures packets for 100 seconds

Displays 100 lines of output

Filters to port 100

8. What is the primary purpose of tcpdump?

Capture and display network packets in real-time

Configure network interfaces and IP addresses

Monitor CPU and memory usage

Manage firewall rules and policies

9. What does the -n flag in tcpdump prevent?

Name resolution of IP addresses

Network interface selection

Packet capture initiation

File write operations

10. How do you capture traffic on port 443 only?

Tcpdump port 443

Tcpdump -p 443

Tcpdump filter 443

Tcpdump -port 443

11. What does the expression 'host 192.168.1.100' do in tcpdump?

Captures traffic from or to that specific IP address

Displays all traffic on the 192.168.1.0/24 subnet

Filters traffic by hostname only

Blocks traffic from that IP address

12. How would you read a previously captured tcpdump file?

Tcpdump -r filename.pcap

Tcpdump -w filename.pcap

Tcpdump -i filename.pcap

Tcpdump -f filename.pcap

13. What does the -w flag in tcpdump do?

Display output in verbose mode

Write captured packets to a file

Filter packets by protocol

Show packet details without resolving names

14. Which flag is used to capture packets on a specific network interface with tcpdump?

-i

-n

-v

-w

15. What is the correct syntax to capture DNS traffic (port 53)?

Tcpdump port 53

Tcpdump dns

Tcpdump udp port 53

All of the above

16. Which tcpdump filter expression captures only TCP traffic?

Tcp

Protocol tcp

Filter tcp

Type tcp

17. What is the default snapshot length (-s flag) in tcpdump?

65535 bytes

1500 bytes

256 bytes

Unlimited

18. How do you filter for packets with the TCP SYN flag set?

Tcpdump 'tcp[tcpflags] & tcp-syn != 0'

Tcpdump tcp-syn

Tcpdump -flag syn

Tcpdump syn-packet

19. Which flag increases the verbosity level of tcpdump output?

-v

-vv

-vvv