TheoryPractice
Browse exams
Home › SecurityX Test Prep › Question 8 of 10
SecurityX Test PrepQuestion 8 / 10

What does the Wireshark "tcp.flags.syn == 1 and tcp.flags.ack == 0" filter do?

Practise this SecurityX Test Prep question free, then download the PDF, watch the video walkthrough, or unlock timed mock exams for the full web bank.
Download PDFWatch video
Multiple choice — select the best answer
✓ Correct answer: A. Filter for TCP SYN packets Answer: Filter for TCP SYN packets The Wireshark filter "tcp.flags.syn == 1 and tcp.flags.ack == 0" is used to capture TCP SYN packets. TCP SYN packets are the first step in the TCP three-way handshake and are useful for identifying network connections being initiated. The command "tcp.flags.syn == 1 and tcp.flags.ack == 0" would be used within Wireshark to filter out only SYN packets, which are used to initiate TCP connections. Other filters such as "tcp.port" for port-specific traffic and "ip.addr" for traffic from a specific IP address can be combined with this filter for more granular monitoring. Filtering for TCP SYN packets can help network security professionals monitor for new connection attempts and potential scan activities.

Keep practising. Use the free SecurityX Test Prep PDF, watch the YouTube walkthrough, or unlock all 10 web questions with timed mock exams.

Free PDFVideo walkthrough
← Previous Next → 🎲 Random question ↩ Back to all questions
Keep practising

Related questions

Free practice here. Timed mocks when you are ready.

Study the SecurityX Test Prep free question explanations, download the PDF, then unlock timed mock exams on the web when you want exam-day practice.

Download PDFStart practice test