CEH Practice Question: Malware, Social Engineering and Network Attacks
An analyst uses the following command to capture traffic: tcpdump -i eth0 -w capture.pcap host 10.0.0.5 and port 80. After generating traffic from a web server at 10.0.0.5, the analyst examines the pcap with Wireshark. What type of traffic will appear in the capture?
⚠ Common exam trap
Test-takers frequently assume `host` implies only traffic originating from the specified IP, but in BPF syntax, `host` captures bidirectional traffic unless modified with `src` or `dst`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HTTP traffic to and from 10.0.0.5
The command `tcpdump -i eth0 -w capture.pcap host 10.0.0.5 and port 80` captures only packets that match both conditions: the IP address is 10.0.0.5 (source or destination) and the port is 80 (source or destination). Since port 80 is the default HTTP port, this filter captures HTTP traffic to and from the web server at 10.0.0.5. The `host` keyword includes both directions, so the capture is not limited to traffic originating from the server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
All HTTP traffic on the network
Why it's wrong here
The "host 10.0.0.5" filter explicitly limits the capture to packets where 10.0.0.5 is either the source or destination IP address. This significantly narrows the scope, preventing the capture of HTTP traffic involving any other hosts on the network. Therefore, it does not capture *all* HTTP traffic, only HTTP traffic related to this specific host.
- ✓
HTTP traffic to and from 10.0.0.5
Why this is correct
The "host 10.0.0.5" filter inherently captures traffic where 10.0.0.5 is either the source or the destination IP address, encompassing both inbound and outbound communications. Coupled with "port 80", which identifies standard HTTP traffic, this command precisely targets all HTTP conversations involving the specified host, regardless of direction.
- ✗
Only HTTP traffic originating from 10.0.0.5
Why it's wrong here
The "host 10.0.0.5" filter is a bidirectional specifier, meaning it includes packets where 10.0.0.5 is the source *or* the destination. To capture *only* traffic originating from 10.0.0.5, the filter would need to be more specific, such as "src host 10.0.0.5". Without "src", the command captures both outgoing and incoming HTTP traffic related to the host.
- ✗
All traffic from 10.0.0.5 on any port
Why it's wrong here
The "and port 80" clause explicitly restricts the capture to traffic utilizing TCP or UDP port 80. This means any other port traffic, even if originating from or destined for 10.0.0.5, will be excluded from the capture. Therefore, the command does not capture *all* traffic from the host, only that specifically on port 80.
Visual reference
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.