Which tool is a protocol analyzer commonly used to capture and inspect network packets?

Which tool is a protocol analyzer commonly used to capture and inspect network packets?

• A. tcpdump
• B. tracert
• C. nslookup
• D. arp

Answer: (A)

Capturing and examining the details of network traffic is what a protocol analyzer does. tcpdump is a widely used command-line protocol analyzer that captures packets on a network interface and decodes them into readable headers and payload information. It lets you apply filters to limit what you capture, making it practical for diagnosing issues or understanding traffic flows, and you can save captures for later analysis. Tracert (trace route) shows the path packets take across the network by sending probes and recording each hop; it doesn’t capture and display live packet contents. Nslookup queries DNS to resolve domain names to IP addresses or vice versa, not protocol contents. Arp resolves IP addresses to MAC addresses on the local network and does not provide packet capture or inspection. So for capturing and inspecting packets, tcpdump is the best fit.

Capturing and examining the details of network traffic is what a protocol analyzer does. tcpdump is a widely used command-line protocol analyzer that captures packets on a network interface and decodes them into readable headers and payload information. It lets you apply filters to limit what you capture, making it practical for diagnosing issues or understanding traffic flows, and you can save captures for later analysis.

Tracert (trace route) shows the path packets take across the network by sending probes and recording each hop; it doesn’t capture and display live packet contents. Nslookup queries DNS to resolve domain names to IP addresses or vice versa, not protocol contents. Arp resolves IP addresses to MAC addresses on the local network and does not provide packet capture or inspection.

So for capturing and inspecting packets, tcpdump is the best fit.