To check for POP3 traffic using Ethereal, which port should you filter by?

To check for POP3 traffic using Ethereal, which port should you filter by?

• A. 143
• B. 25
• C. 110
• D. 125

Answer: (C)

POP3 traffic is carried over TCP on a specific port by default. When you’re using Ethereal (Wireshark) to isolate POP3 activity, you filter for the port associated with that service, which is 110. This is the standard, unencrypted POP3 port, so filtering on that port will capture POP3 exchanges between clients and servers. The other ports correspond to different services: 143 is IMAP, 25 is SMTP, and 125 is not a standard port for these email protocols. If you were looking at POP3 over TLS, you’d filter on 995 instead. In short, for standard POP3 traffic, filter by port 110.

POP3 traffic is carried over TCP on a specific port by default. When you’re using Ethereal (Wireshark) to isolate POP3 activity, you filter for the port associated with that service, which is 110. This is the standard, unencrypted POP3 port, so filtering on that port will capture POP3 exchanges between clients and servers.

The other ports correspond to different services: 143 is IMAP, 25 is SMTP, and 125 is not a standard port for these email protocols. If you were looking at POP3 over TLS, you’d filter on 995 instead. In short, for standard POP3 traffic, filter by port 110.