At a bank, two recorded flows use the same source IP address and the same destination IP address. One flow is TCP to port 443 and the other is TCP to port 22. Which 5-tuple field separates the two flows?
Select an answer to reveal the explanation.
Short Explanation
Picture two shipping labels that already share the same from and to addresses. You separate those bank flows by the destination port, 443 versus 22, with TCP unchanged on both. The trap is a shared address or a payload hash that is not on the five-field label.
Full Explanation
A 5-tuple is source IP, destination IP, source port, destination port, and protocol. Both bank flows already use the same two addresses, and both are TCP, so those three fields do not tell the rows apart. The recorded difference is the service port each session uses. "Destination port, recorded as 443 on one TCP flow and as 22 on the other flow" is the field that separates them. "Source IP address, the same client address on both of the recorded bank flows" is shared, so it cannot distinguish the rows. "Destination IP address, the same server address on both of the recorded bank flows" is shared as well and fails for the same reason. "Payload hash of the captured bytes, a fingerprint that is not one of the 5-tuple fields" is a file digest, not one of the five fields, so it is not the separator this question asks for. Exam caveat: a source port can also differ in other captures, but this stem already names the split as 443 versus 22. Operational check: put the two flow rows side by side and confirm the addresses and protocol match while the destination ports do not.