Cisco Certified Internetwork Expert (CCIE) Practice Test

Which TCP dump filter would best verify that traffic is reaching a Linux server?

1. tcpdump -i eth0 host 10.10.7.4 and host 11.0.1.9 and port 8080

2. tcpdump -i eth0 host 10.10.7.4 and 11.0.1.9

3. tcpdump -i eth0 src 10.10.7.4 and dst 11.0.1.9 and dst port 8080

4. tcpdump -i eth0 dst 11.0.1.9 and dst port 8080

The correct answer is: tcpdump -i eth0 src 10.10.7.4 and dst 11.0.1.9 and dst port 8080

The selected choice effectively captures traffic that is specifically directed to the Linux server at IP address 11.0.1.9, while also filtering for the appropriate source of that traffic. By using "src 10.10.7.4," the filter targets packets coming from the source address attempting to reach the destination. The inclusion of "dst" for the destination and "dst port 8080" ensures that the filter is honing in on the relevant traffic, which is crucial for confirming that the packets are both originating from the intended source and arriving at the correct server on the desired port. This approach is particularly useful in troubleshooting scenarios, as it isolates the traffic flow to just the interactions between these two endpoints, making it easier to determine if traffic is successfully reaching the server as intended. The combination of source and destination checks, along with the specific port, allows for a precise examination of the traffic. In contrast, other options might not serve this verification purpose effectively. Some options may include both source and destination correctly but miss filtering by the right port number, or they might not include the necessary distinctions between source and destination traffic. This specificity is essential when examining traffic flows and ensuring successful communication to the Linux server.