Which of the following tools is an open source protocol analyzer that can capture traffic in real
time?
A.
Netresident
B.
Wireshark
C.
Snort
D.
NetWitness
Explanation:
Wireshark is an open source protocol analyzer that can capture traffic in real time. Wireshark is a
free packet sniffer computer application. It is used for network troubleshooting, analysis, software
and communications protocol development, and education. Wireshark is very similar to tcpdump,
but it has a graphical front-end, and many more information sorting and filtering options. It allows
the user to see all traffic being passed over the network (usually an Ethernet network but support
is being added for others) by putting the network interface into promiscuous mode.
Wireshark uses pcap to capture packets, so it can only capture the packets on the networks
supported by pcap. It has the following features:
Data can be captured “from the wire” from a live network connection or read from a file that
records the already-captured packets.
Live data can be read from a number of types of network, including Ethernet, IEEE 802.11, PPP,
and loopback.Captured network data can be browsed via a GUI, or via the terminal (command line) version of
the utility, tshark.
Captured files can be programmatically edited or converted via command-line switches to the
“editcap” program.
Data display can be refined using a display filter. Plugins can be created for dissecting new
protocols.
Answer option C is incorrect. Snort is an open source network intrusion prevention and detection
system that operates as a network sniffer. It logs activities of the network that is matched with the
predefined signatures. Signatures can be designed for a wide range of traffic, including Internet
Protocol (IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet
Control Message Protocol (ICMP).
Answer option D is incorrect. NetWitness is used to analyze and monitor the network traffic and
activity.
Answer option A is incorrect. Netresident is used to capture, store, analyze, and reconstruct
network events and activities.