In Wireshark, which display filter tokens are used to specify IP addresses and TCP ports?

In Wireshark, which display filter tokens are used to specify IP addresses and TCP ports?

• A. ip.src, ip.dst, tcp.port, tcp.srcport, tcp.dstport
• B. dns.name, http.host
• C. arp.src, arp.dst
• D. mac.addr

Answer: (A)

In Wireshark, you filter on fields from the packet headers. To target IPs you use ip.src for the source IP and ip.dst for the destination IP. For TCP ports, you can use tcp.srcport and tcp.dstport to filter on the ports on each side, or use tcp.port as a convenient way to match either side’s port. So the tokens ip.src, ip.dst, tcp.port, tcp.srcport, and tcp.dstport together cover filtering by IP addresses and TCP ports. Other tokens correspond to DNS names, HTTP host, ARP addresses, or MAC addresses, which aren’t the IP/TCP port fields in question.

In Wireshark, you filter on fields from the packet headers. To target IPs you use ip.src for the source IP and ip.dst for the destination IP. For TCP ports, you can use tcp.srcport and tcp.dstport to filter on the ports on each side, or use tcp.port as a convenient way to match either side’s port. So the tokens ip.src, ip.dst, tcp.port, tcp.srcport, and tcp.dstport together cover filtering by IP addresses and TCP ports. Other tokens correspond to DNS names, HTTP host, ARP addresses, or MAC addresses, which aren’t the IP/TCP port fields in question.