CEH Practice Question: Malware, Social Engineering and Network Attacks

An analyst runs the following command: `tcpdump -i eth0 src host 192.168.1.10 and dst port 80 -w http_traffic.pcap`. What is the primary purpose of this command?

⚠ Common exam trap

Many candidates confuse the `-w` (write to file) option with `-r` (read from file) or assume tcpdump displays output in real-time by default, leading them to choose Option B, even though the filter and `-w` flag clearly indicate a targeted capture to a file.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To capture only HTTP traffic from a specific source IP and save it to a file

The command `tcpdump -i eth0 src host 192.168.1.10 and dst port 80 -w http_traffic.pcap` uses a BPF (Berkeley Packet Filter) expression to capture only packets originating from source IP 192.168.1.10 and destined for TCP port 80 (HTTP). The `-w` flag writes the filtered packets directly to a pcap file, not to standard output, making the primary purpose to capture and save specific HTTP traffic for later analysis.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
To perform a man-in-the-middle attack on HTTP traffic
Why it's wrong here
Tcpdump is a passive packet sniffing tool designed for network monitoring and analysis, not for active network attacks. Performing a man-in-the-middle (MITM) attack requires active manipulation of network traffic, such as ARP spoofing or DNS poisoning, to redirect or modify packets. Tcpdump merely observes and records traffic without altering its flow or injecting malicious data, making it incapable of executing an MITM attack.
✗
To capture all traffic on eth0 and display it in real-time
Why it's wrong here
This statement is incorrect because the command includes specific filters (`src host 192.168.1.10 and dst port 80`), which means it will only capture traffic matching these criteria, not 'all traffic' on `eth0`. Furthermore, the presence of the `-w capture.pcap` flag directs all captured packets to be written to a file named `capture.pcap` for later review, explicitly preventing real-time display of the traffic to the console.
✓
To capture only HTTP traffic from a specific source IP and save it to a file
Why this is correct
This option accurately describes the command's functionality. The `-i eth0` flag specifies the network interface for capture. The `src host 192.168.1.10` filter ensures only packets originating from that specific IP address are captured, while `dst port 80` further narrows the scope to only include HTTP traffic (standard port 80). Finally, the `-w capture.pcap` flag instructs tcpdump to save all filtered packets to a file named `capture.pcap` for subsequent offline analysis.
✗
To analyze the payload of HTTP packets in real-time
Why it's wrong here
While tcpdump can display packet payloads in real-time using flags like `-A` or `-X`, the inclusion of the `-w capture.pcap` flag fundamentally changes its behavior. This flag directs all captured network data to be written to a specified file on the disk, rather than displaying it on the console. Therefore, the command saves the packets for *later* analysis, making real-time payload inspection directly from this specific command impossible.

Visual reference

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question