GCED: GIAC Certified Enterprise Defender

By GIAC · Question Mode

QuestionQ4

Intrusion Detection and Packet Analysis

An analyst will capture traffic from an air-gapped network that does not use DNS. The analyst needs to identify unencrypted Syslog data in transit. Which of the following is the most efficient for this purpose?

Explanation

UDP port 514 is the standard Syslog transport port, whereas port 6514 is designated for secure Syslog transports. The -n flag avoids DNS and service-name resolution, which is appropriate for an air-gapped network, and -X displays packet payload in hexadecimal and ASCII so plaintext Syslog messages can be inspected. RFC 5426: Transmission of Syslog Messages over UDP

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!