Fundamentals of InfoSecadvanced
A capture contains thousands of packets. Describe how address filters, port filters, and coloring rules can help an analyst, and explain one limitation of these tools.
Answer
An address filter such as `ip.addr==10.0.0.5` narrows the displayed packets to traffic associated with that address. A port filter such as `tcp.port==80` focuses on Transmission Control Protocol traffic using port 80, while a protocol filter such as `http` focuses on identified HTTP packets. Coloring rules make packet categories easier to recognize visually. These tools organize captured evidence but do not determine whether traffic is malicious, guarantee that the capture is complete, or authorize monitoring.
Explanation
### Why this is right
Address, port, and protocol filters reduce the visible packet set in different ways, while coloring rules provide visual cues. None of these features independently determines intent or guarantees that the capture includes every relevant packet.
### The concept
A filter is a query against captured packet metadata or protocol interpretation. Address filtering focuses on endpoints, port filtering focuses on transport endpoints, and protocol filtering focuses on identified protocols. Coloring rules assist human review but are not a security verdict. Analysts should correlate packet evidence with context and respect the limits of the capture point.
### What a good answer covers
- Explain what address, port, and protocol filters select.
- Describe coloring rules as a visual aid.
- State that filters do not prove maliciousness or completeness.
- Include authorization and data handling as part of responsible analysis.
### Terms
- **IP**: Internet Protocol. Provides packet addressing between networks.
- **TCP**: Transmission Control Protocol. A transport protocol for reliable, ordered communication.
- **HTTP**: Hypertext Transfer Protocol. A protocol for web requests and responses.
### Remember
A filtered capture is a focused view of evidence, not a verdict about the evidence.
Related Questions
- Explain why computer security is described as a process rather than a product. Include the roles of technology, people, and environment.(intermediate)
- Select ALL items the review identifies as possible security risks or losses.(intermediate)
- Arrange these broad security activities in a sensible cycle, beginning with identifying what needs protection.(intermediate)
- A security product can replace the continuing work of managing people, technology, and the operating environment.(intermediate)
- Which statement best captures the course review’s view of computer security?(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free