LPIC-2 Advanced Networking Configuration Practice Question
A security analyst wants to capture only TCP packets with the SYN flag set to identify connection attempts. Which tcpdump filter expression accomplishes this?
⚠ Common exam trap
Test-takers frequently assume `tcp-syn` is a valid tcpdump filter keyword (like `icmp` or `arp`), but tcpdump does not define symbolic names for individual TCP flags, requiring the use of raw byte offsets and bitmasks instead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Both B and C are correct. [CORRECT]
Both B and C correctly filter TCP packets with the SYN flag set. Note that in the question stem, options B and C are incorrectly marked as '[wrong]', but they are actually valid filters. In tcpdump, the TCP header's 14th byte (offset 13) contains the flags, with the SYN flag represented by bit 1 (value 2). Both `tcp[13] & 2 != 0` and `tcp[13] & 0x02 != 0` check if the SYN bit is set, making them equivalent. Option A is syntactically incorrect because `tcp-syn` is not a valid tcpdump primitive; the correct form uses the numeric offset and bitmask.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
tcp[tcpflags] & tcp-syn != 0 [wrong]
Why it's wrong here
tcpflags and tcp-syn are not predefined in tcpdump.
- ✗
tcp[13] & 2 != 0
Why it's wrong here
This is a valid tcpdump filter expression that checks if the SYN flag (bit 1, value 2) is set.
- ✗
tcp[13] & 0x02 != 0
Why it's wrong here
This is a valid tcpdump filter expression that checks if the SYN flag (bit 1, value 0x02) is set.
- ✓
Both B and C are correct. [CORRECT]
Why this is correct
Both expressions correctly filter for the SYN flag.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.