You find that a host (192.168.1.4) being used on one of your client's networks has been compromised with a backdoor program listening on port 31337. Your client requests a list of originating IP addresses connecting to that port. Using a Linux workstation as traffic analyzer, which of the following commands would gather the data requested by the client?
A.
tcpdump host 192.168.1.4 and port 31337 -w out
B.
nmap host 192.168.1.4:31337
C.
arpwatch -n 192.168.1.4/32 -p 31337 < capture
D.
pcap -d 192.168.1.4:31337
E.
ipwatch --syn 192.168.1.4 -p 31337 --1og=out
題解
位址解析協定(ARP, Address Resolution Protocol)可用IP位址來查詢對應到的MAC位址。
選項A，「tcpdump」指令可以用來顯示網路介面的封包。為正確答案。
選項B，「nmap」指令可以用來探測及掃描網路。
選項C，「arpwatch」指令可以監聽與記錄區域網絡中的ARP封包，同時將變化報告利用E-mail來寄送。
選項D，沒有「pcap」指令。
選項E，沒有「ipwatch」指令。