Question 1

Tom accesses host C with IP address IPC via host B with IP address IPB from host A with IP address IPA using SSH. How to capture all the TCP response traffic of the incoming link of Host B?

Question options:

	tcpdump tcp src IPB and dst IPA and src port 22 and 'tcp[13] & 8 !=0'
	tcpdump tcp src IPB and dst IPA and src port 22 and 'tcp[13] & 16 !=0'
	tcpdump tcp src IPB and dst IPA and dst port 22 and 'tcp[13] & 8 !=0'
	tcpdump tcp src IPB and dst IPA and port 22 and 'tcp[13] & 8 !=0'

Question 6

Tom accesses host C with IP address IPC via host B with IP address IPB from host A with IP address IPA using SSH. How to capture all the TCP traffic from Host A to Host B?

Question options:

	tcpdump tcp src IPA or dst IPB and dst port 22
	tcpdump src IPA and dst IPB and dst port 22
	tcpdump tcp src IPA and dst IPB and dst port 22
	tcpdump tcp src IPA and dst IPB and src port 22

Question 9

In three way handshake of establishing a TCP connection, if a client sends a SYN packet to a server with source port, destination port, sequence number, and acknowledgement number as the following respectively.

8971, 22, 156, 305

And also the SYN is acknowledged by a packet with sequence number 588. In the last step to set up the TCP connection, the client needs to send an ACK to the server. What are the values of source port, destination port, sequence number and the acknowledgement number of the ACK respectively?

Question options:

	22, 8971, 157, 589
	8971, 22, 157, 589
	8971, 22, 589, 157
	8971, 22, 157, unknown

Question 10

The following packet captured by Tcpdump shows "win 512" which indicates ___________________.

09:32:43:910000 nmap.edu.1173 > dns.net.21 S 62697789:62697789(0) win 512

Question options:

	host "dns.net" available buffer size is 512 bytes
	host "dns.net" total window buffer size is 512 bytes
	host "nmap.edu" available buffer size is 512 bytes
	host "nmap.edu" total window buffer size is 512 bytes

Question 13

Please examine the following two packets. What is the sequence number of the packet sent from port 3224 to port 6020?

23:29:04.050167 spider.3224 > 66-28-147-032.servercentral.net.6020: . ack 36517 win 16044

23:29:04.059645 66-28-147-032.servercentral.net.6020 > spider.3224: P 36517:37969(1452) ack 1 win 5840 (DF)

Question options:

	0
	37969
	36517
	1

Question 16

The following is a TCP packet captured by Tcpdump. If an acknowledgement is sent from port 32772 to 33635 to acknowledge the data received from port 33635, what would be the acknowledgement number?

16:23:01.079553 churchward.erg.abdn.ac.uk.33635 > gordon.erg.abdn.ac.uk.32772: P 12765:12925(160) ack 19829 win 24820 (DF)

Question options:

	12765
	12925
	12926
	12766

Question 17

Tom accesses host C with IP address IPC via host B with IP address IPB from host A with IP address IPA using SSH. How to capture all the TCP request traffic of the outgoing link of Host B?

Question options:

	tcpdump tcp src IPB and dst IPC and dst port 22 and 'tcp[13] &8!=0'
	tcpdump tcp src IPB and dst IPC and dst port 22 and 'tcp[13] &32!=0'
	tcpdump tcp src IPB and dst IPC and port 22 and 'tcp[13] &16!=0'
	tcpdump tcp src IPB or dst IPC and dst port 22 and 'tcp[13] &8!=0'

Question 19

The command "tcpdump src host churchward and udp dst port 53" is to capture ______.

Question options:

	the udp packets coming from host churchward, but tcp packets going to port 53
	the tcp packet going to port 53 from host churchward
	the tcp packets coming from host churchward, but udp packets going to port 53
	the udp packets coming from host churchward, but going to port 53