Exam CFR-310 topic 1 question 3 discussion

A. # tcpdump -i eth0 host 88.143.12.123 Assumes the command is issued from 192.168.10.121 Explanation: The host keyword in this command captures all traffic involving the host 88.143.12.123. This includes traffic both to and from the IP address 192.168.10.121, which means it captures all interactions between the two hosts. It is the most appropriate filter in this scenario.

At a glance, none of the options seems exactly right, providing only partially useful output. Given the limitations of the provided options, we must think critically about the assumptions inherent in the question. In order for any of the answers to be correct, we must assume that the command is being issued from one of the identified hosts. Since "A Linux system administrator found suspicious activity on host IP 192.168.10.121", given the IP structure of the two hosts, we should assume the administrator is issuing the command from the host ending in 121. In this context, the correct answer would be: A. # tcpdump -i eth0 host 88.143.12.123 When this command is issued from host 121 (192.168.10.121), it instructs tcpdump to capture traffic where the specified host (88.143.12.123) is either the source or destination. Essentially, it will capture all traffic involving communication between host 121 and the remote host 88.143.12.123.

The answer is C. So, while option C captures traffic involving 192.168.10.121, it doesn't specifically isolate the traffic between the two hosts.