LPIC-1 Essential System Services and Networking Practice Question
A system administrator wants to monitor network traffic on a specific port (TCP/443) entering the server. Which command will capture packets on interface eth0 and display them in real-time?
⚠ Common exam trap
It's easy for candidates to confuse commands that show socket state (netstat/ss) with commands that capture live packets (tcpdump), leading them to pick a command that only lists current connections rather than monitoring traffic in real-time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
tcpdump -i eth0 port 443
C is correct because `tcpdump -i eth0 port 443` captures packets on interface eth0 filtering for TCP port 443 (HTTPS) and displays them in real-time as they arrive. This command uses the libpcap library to intercept raw network frames, making it the standard tool for live packet capture and analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
netstat -tulpn | grep :443
Why it's wrong here
netstat -tulpn enumerates listening TCP/UDP sockets and their processes; it neither captures packets nor displays live traffic on eth0. It is tempting because it is the classic tool for verifying that a service is bound to port 443, which answers a related but different question about socket state.
- ✗
ss -tulpn | grep :443
Why it's wrong here
ss -tulpn lists listening sockets and established connections with owning processes; it shows no packet payloads and cannot capture traffic on eth0. It is tempting because it quickly confirms whether something is listening on TCP/443, which is useful for checking service availability rather than inspecting live packets.
- ✓
tcpdump -i eth0 port 443
Why this is correct
tcpdump captures live packets on a named interface, and the port 443 filter restricts output to TCP/443 traffic, satisfying both the interface and real-time display requirements. Other tools either read saved files or lack equivalent filtering.
- ✗
iptables -L -n -v
Why it's wrong here
iptables -L -n -v lists firewall rules and packet counters, not live packet contents on eth0, so it cannot capture traffic on TCP/443. It is tempting because it reports per-rule packet and byte counts, which is useful for confirming whether traffic is being permitted or dropped by the firewall.
Visual reference
Go deeper
Related to this question
About these practice questions
This LPIC-1 question is part of Courseiva's 402-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.