In a packet capture, what does the expression tcp.srcport == 514 indicate?

• A. The destination port is being used for syslog messages.
• B. The source port is being used for syslog messages.
• C. The traffic uses HTTPS.
• D. The host is using FTP.

Answer: (B)

The expression targets the source port in the TCP header. The number 514 is the standard port used by syslog. So tcp.srcport == 514 selects packets where the sender’s TCP port is 514, meaning the traffic is originating from the syslog service. In practice, syslog over TCP uses port 514 on the receiver side, so the server’s responses (or the client if misconfigured) will show 514 as the source port. This clarifies why this filter points to syslog-related activity. It wouldn’t indicate HTTPS or FTP, which use different ports.