An analyst uses Wireshark to capture traffic and applies the filter tcp.flags.syn==1 && tcp.flags.ack==0. What does this filter capture?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the filter isolates initial SYN packets (SYN=1, ACK=0), which represent new connection initiation requests; a high rate of these to many ports indicates a SYN port scan. A is wrong because completed handshakes require SYN, SYN-ACK, and ACK packets; this filter shows only the SYN stage.
Full explanation below image
Full Explanation
B is correct because the filter isolates initial SYN packets (SYN=1, ACK=0), which represent new connection initiation requests; a high rate of these to many ports indicates a SYN port scan. A is wrong because completed handshakes require SYN, SYN-ACK, and ACK packets; this filter shows only the SYN stage. C is wrong because keepalives use ACK-only packets (ACK=1, SYN=0). D is wrong because RST packets have the RST flag set, not SYN.