GCIH: GIAC Certified Incident HandlerDemo

By GIAC · Question Mode

QuestionQ9

Network and Log Investigations

Which of the following is an example of a Berkeley Packet Filter (BPF) expression?

  • A [\w._%+-]
  • B 'not src host 10.1.12.52'
  • C icmp -j DROP
  • D {$_.Enabled -eq $True}
Explanation

BPF capture-filter syntax can match packet fields such as source hosts and negate a match. not src host 10.1.12.52 selects packets that did not originate from the specified IP address.

Community Discussion

No comments yet. Be the first to start the discussion!