Which term describes filtering by IPs and ports in packet analysis?

Which term describes filtering by IPs and ports in packet analysis?

• A. Wireshark Filters
• B. tcpdump Filters
• C. Wireshark Display Filters
• D. Packet Filter Language

Answer: (C)

Filtering by IPs and ports in packet analysis is done with Wireshark Display Filters. These filters are applied to the captured data in the Wireshark interface, letting you view only packets that match criteria like ip.addr == 192.168.1.5 or tcp.port == 80. They’re evaluated after capture, so you can refine your view without starting a new capture. This is different from capture filters, which determine what data is collected at the moment you start capturing and use a different syntax. The other terms aren’t the standard label for this in Wireshark.

Filtering by IPs and ports in packet analysis is done with Wireshark Display Filters. These filters are applied to the captured data in the Wireshark interface, letting you view only packets that match criteria like ip.addr == 192.168.1.5 or tcp.port == 80. They’re evaluated after capture, so you can refine your view without starting a new capture. This is different from capture filters, which determine what data is collected at the moment you start capturing and use a different syntax. The other terms aren’t the standard label for this in Wireshark.