MENU
An analyst will capture traffic from an air-gapped network that does not use DNS. The analyst is looking for unencrypted Syslog data being transmitted. Which of the following is most efficient for this purpose?
Suggested Answer: B
Get Premium GCED Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
When using tcpdump, a --n switch will tell the tool to not resolve hostnames; as this network makes no use of DNS this is efficient. The --vv switch increases the tools output verbosity. The --s0 increases the snaplength to ''all'' rather than the default of 96 bytes. The --nnvvX would make sense here except that the port in the filter is 6514 which is the default port for encrypted Syslog transmissions.
3 comments · newest first
DA
Darci
2 days ago
I feel like we did a similar question in class, and I think the flags matter too. I just can't recall which ones are best for capturing the data.
CO
Coletta
8 days ago
I think Syslog typically uses port 514, so maybe options A or C are more relevant for unencrypted data.
YO
Yong
13 days ago
I remember we practiced using tcpdump, but I'm not sure if the port number is the key factor here.