Hospital connection logs show many lines that share one source address, use varying destinations, destination port 443, and TCP, while other sources appear once. How does the 5-tuple isolate the host to inspect?
Select an answer to reveal the explanation.
Short Explanation
In a crowded lobby, you find the regular by the badge that keeps showing up, not by the door everyone uses. The repeated source address is the host to inspect; destination port 443 and TCP are just the common door. The trap is deciding the internet is infected, reading the protocol as a person, or blaming the longest packet.
Full Explanation
A 5-tuple is source IP, destination IP, source port, destination port, and protocol. These hospital lines share one source address, vary the destinations, use destination port 443, and use TCP, while other sources appear once. The field that isolates the busy host is the source address that keeps repeating. The isolation is "The repeated source address is the host to inspect, unlike sources that appear only once". Destination port 443 is a common service port. Sharing it does not mean every remote host is infected, so "The shared destination port means the internet side is infected and every remote host is the problem" fails. The protocol field here is TCP. It does not name a person, so "The protocol field names the person who started the sessions from the hospital floor" fails. Packet length is not one of the five fields. The longest packet is not how this tuple picks the host, so "The longest packet in the log is the attacker, apart from any of the five tuple fields" fails. Exam caveat: a repeated source can be a translator shared by many hosts, so confirm this address is a hospital endpoint before calling it the compromised machine. Operational check: filter the log on that source address and review its destination set, keeping port 443 and TCP as context rather than as the identity of the host.