At an agency, a capture line lists source 198.51.100.10, destination 198.51.100.20, destination port 445, and protocol TCP. Which element shows the service the sender contacted?
Select an answer to reveal the explanation.
Short Explanation
The apartment number tells you which door was used, and the sender's street does not. You are asked which element shows the service, and destination port 445 is that element on a TCP line. The trap is answering with the source address, the packet length, or a note someone typed later.
Full Explanation
On a TCP conversation the destination port is the port the sender contacted, and that port is what identifies the service on the target host. Port 445 is the port used for SMB, so this line shows the sender reached that service on 198.51.100.20. Destination port 445, the field that identifies the service contacted on the target host, is the element that answers the question. Source address 198.51.100.10 taken by itself, with no port read from the same capture line, identifies the sender and does not name the service that was contacted. The packet length value from the capture, read without the port and without the protocol, is a size, and size does not identify a service. An analyst comment typed into the capture file after the packet had already been saved is an annotation, not a header field from the packet. On the exam, the service is read from the destination port together with the transport, not from the source address and not from a comment added after the capture. In operations, record destination address, destination port, and protocol from the line before anyone relies on a note stored beside the file.