If you capture traffic from multiple hosts, which method helps identify the origin host for a given activity?

• A. Use only the DNS hostname
• B. Use ip.addr filtering combined with endpoint data in Endpoints/Conversations to correlate source IPs with MACs and hosts
• C. Use only the Destination IP
• D. Use only the TCP port number

Answer: (B)

When you capture traffic from several hosts, you need to know which machine actually generated a given activity. IP addresses alone can be ambiguous in a multi-host capture, so you want to tie the observed IP to the physical host.

Filtering by the IP address narrows the view to all frames involving that address (as source or destination). To identify the exact origin, you then cross-check with endpoint data: the Endpoints and Conversations information shows mappings between IPs, MAC addresses, and often host names. By correlating the source IP with its associated MAC and hostname in these records, you can determine which host originated the activity.

Relying only on a DNS hostname isn’t always reliable or available, and using only the destination IP or only the TCP port number doesn’t reveal which machine started the traffic. Combining an IP filter with endpoint correlation gives the most accurate origin identification.