What approach helps determine the origin of traffic when capturing from multiple hosts?

• A. Use ip.addr filtering combined with Endpoints/Conversations to map sources to MACs and hosts
• B. Use only the MAC address
• C. Use only the Destination IP
• D. Use only the DNS hostname

Answer: (A)

When you’re capturing traffic from several hosts, the simplest attribute like the source MAC or the destination IP can be misleading for attribution. The reliable way to determine where traffic really came from is to focus on the IP involved and then tie that IP to the actual host and its MAC on the network. Filtering with ip.addr isolates the packets related to a given address, which is essential when you have a lot going on on the wire. Once you’ve isolated those packets, using the Endpoints and Conversations views lets you map that IP to the corresponding MAC address and to the host name or identifier. This cross-referencing shows who owns the IP on the network and which device actually sent the traffic across the segment you’re capturing.

Relying solely on the MAC address isn’t trustworthy across multiple hops or on networks with switches and NAT, because the MAC seen on one segment may not reflect the original sender once traffic traverses devices. Using only the Destination IP doesn’t reveal who originated the traffic, it only shows who was being contacted. DNS hostname alone can be unreliable if DNS isn’t consistent, absent, or if the traffic isn’t tied to a resolvable name. By combining ip.addr filtering with the endpoint and conversation mappings, you get a clearer, more accurate picture of which host on the network originated the traffic.