CheckPoint 156-582 Exam - Topic 5 Question 7 Discussion

Actual exam question for CheckPoint's 156-582 exam

Question #: 7
Topic #: 5

[All 156-582 Questions]

Running tcpdump causes a significant increase on CPU usage, what other option should you use?

Afw monitor

BWait for out of business hours to do a packet capture

Ccppcap

DYou need to use tcpdump with -e option to decrease the length of packet in captures and it will utilize the less CPU

Show Suggested Answer

Suggested Answer: A

Yes, it is possible to analyze ICMP packets with tcpdump. While tcpdump is often associated with capturing TCP packets, it is not limited to them and can capture and analyze any protocol that traverses the network, including ICMP, which operates at Layer 3 (Network Layer) of the OSI model. ICMP packets do not use ports, but tcpdump can filter and display these packets based on other criteria such as type and code fields.

by Shonda at Jan 27, 2025, 02:07 AM

Limited Time Offer

25%

Off

Get Premium 156-582 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Frederick

8 months ago

cppcap? Never tried that one, is it reliable?

upvoted 0 times

...

Dominga

8 months ago

I usually just schedule captures for off-peak hours.

upvoted 0 times

...

Alline

8 months ago

Wait, does using -e really help that much?

upvoted 0 times

...

Buck

8 months ago

Definitely agree, tcpdump can really spike CPU usage.

upvoted 0 times

...

Albert

9 months ago

I've heard fw monitor is a good alternative.

upvoted 0 times

...

Samuel

9 months ago

I thought using the `-e` option with `tcpdump` was supposed to help with performance, but I’m not convinced it really reduces CPU usage significantly.

upvoted 0 times

...

Caprice

9 months ago

I practiced a similar question where `cppcap` was mentioned, but I can't recall if it's actually a viable alternative to `tcpdump`.

upvoted 0 times

...

Maybelle

9 months ago

I think waiting for out of business hours is a good idea, but it doesn't really solve the CPU usage issue during the capture itself.

upvoted 0 times

...

Stevie

9 months ago

I remember reading that using `fw monitor` can be less resource-intensive than `tcpdump`, but I'm not entirely sure if it's the best option here.

upvoted 0 times

...

Ming

9 months ago

Using tcpdump with the -e option to decrease the packet length seems like a good strategy to me. I'll definitely try that if I encounter a similar question.

upvoted 0 times

...

Tegan

9 months ago

The cppcap option sounds interesting, but I'm not familiar with it. I'll have to look into that one a bit more.

upvoted 0 times

...

Wilda

9 months ago

I think the best approach here is to wait for out of business hours to do the packet capture. That way, it won't impact the CPU usage as much.

upvoted 0 times

...

Eileen

9 months ago

Hmm, this is a tricky one. I'm not sure if I should go with the fw monitor option or try to use tcpdump with the -e flag to reduce the packet length.

upvoted 0 times

...

Tamera

1 year ago

If I wanted to increase CPU usage, I'd just run a cryptocurrency miner in the background. At least I'd get some digital coins out of it.

upvoted 0 times

...

Alaine

1 year ago

I think the -e option in tcpdump is the way to go. It's like using a scalpel instead of a sledgehammer to get the job done.

upvoted 0 times

Sherron

1 year ago

D) You need to use tcpdump with -e option to decrease the length of packet in captures and it will utilize the less CPU

upvoted 0 times

...

Clement

1 year ago

C) cppcap

upvoted 0 times

...

Marylin

1 year ago

B) Wait for out of business hours to do a packet capture

upvoted 0 times

...

Francis

1 year ago

A) fw monitor

upvoted 0 times

...

Barrie

1 year ago

Waiting for out of business hours to do a packet capture? That's like waiting for a meteor to hit the earth to get a chance to observe it. Not very practical.

upvoted 0 times