Knowledge Hub

Tcpdump: The Basics

TryHackMe8 answered prompts

Tcpdump: The Basics TryHackMe walkthrough with 8 answered prompts.

Prompts and answers

  • What is the name of the library that is associated with tcpdump?
    libpcap
  • What option can you add to your command to display addresses only in numeric format?
    -n
  • How many packets in traffic.pcap use the ICMP protocol?
    26
  • What is the IP address of the host that asked for the MAC address of 192.168.124.137?
    192.168.124.148
  • What hostname (subdomain) appears in the first DNS query?
    mirrors.rockylinux.org
  • How many packets have only the TCP Reset (RST) flag set?
    57
  • What is the IP address of the host that sent packets larger than 15000 bytes?
    185.117.80.53
  • What is the MAC address of the host that sent an ARP request?
    52:54:00:7c:d3:5b