A university alert lists client port 49822 and server port 445 on the same connection. Which value identifies the service?
Select an answer to reveal the explanation.
Short Explanation
The high-numbered port is the customer who walked up to the counter; the well-known port is the counter itself. You identify the service by server port 445, not by the client ephemeral port. The trap is answering with client port 49822, a process ID, or a TCP sequence number.
Full Explanation
On a TCP connection the server port is the port the destination was listening on, and that port identifies the service. Here the server port is 445, the listening side, commonly direct-hosted file sharing. The client port 49822 is the ephemeral port the workstation chose for this one connection. The service is "Server port 445, the listening port that identifies the service on the destination host". The workstation-selected port does not name the service, so "Client port 49822, the ephemeral port the university workstation chose for this connection" fails. A process ID identifies a running process on a host. It is not the port in this alert's service field, so "The process ID printed beside the alert, treated as though it were the listening service port" fails. A TCP sequence number orders bytes in the stream. It does not name the application, so "The TCP sequence number, treated as the field that names the service in use" fails. Exam caveat: the server port is the service selector in the alert, and a nonstandard host could bind an unexpected process there, which is checked on the host rather than by swapping in the client port. Operational check: confirm the alert's server port is 445 and, on the destination host, see which process is listening if the binary name is needed.