Certified Ethical Hacker (CEH v11) — Question 155

You are a Network Security Officer. You have two machines. The first machine (192.168.0.99) has snort installed, and the second machine (192.168.0.150) has kiwi syslog installed. You perform a syn scan in your network, and you notice that kiwi syslog is not receiving the alert message from snort. You decide to run wireshark in the snort machine to check if the messages are going to the kiwi syslog machine. What Wireshark filter will show the connections from the snort machine to kiwi syslog machine?

Answer options

• A. tcp.srcport= = 514 && ip.src= = 192.168.0.99
• B. tcp.srcport= = 514 && ip.src= = 192.168.150
• C. tcp.dstport= = 514 && ip.dst= = 192.168.0.99
• D. tcp.dstport= = 514 && ip.dst= = 192.168.0.150

Correct answer: D

Explanation

The correct answer is D because it specifies that the destination port is 514 and the destination IP is 192.168.0.150, which is the Kiwi Syslog machine. Option A is incorrect as it refers to the source port and source IP instead of the destination. Option B has an incorrect IP address for the Kiwi Syslog machine, and Option C incorrectly specifies the source IP instead of the destination.