A Linux administrator is attempting to capture all network traffic coming to the server from the 10.0.6.5 IP address. Which of the following commands should the administrator run on the server to achieve the goal?
Correct Answer: C
To capture all traffic from a specific IP address using tcpdump, the correct syntax is:
bash
tcpdump host 10.0.6.5
* host is the correct keyword used to filter packets from or to a specific IP address.
* ip, addr, and net are not valid or appropriate filters in this context:
* ip is a protocol filter, not an address filter.
* net would filter an entire subnet, not a single host.
* addr is invalid syntax for tcpdump.
As described in CompTIA Linux+ XK0-005 Official Study Guide, Domain 2.0 (Networking Tools):
"The tcpdump utility can be used to capture and analyze packets. Use the keyword host to filter traffic to or from a specific IP address."