312-49V11 · Question #93
Dariel, a forensic investigator, has been assigned to investigate a recent security incident that occurred within the organization's network. As part of the investigation, Dariel installs a…
The correct answer is A. tcpdump. According to the CHFI v11 curriculum under Network Forensics, investigators must be proficient in using packet sniffing tools to capture and analyze live network traffic. tcpdump is a widely used command-line packet analyzer that runs natively on Unix, Linux, and BSD-based…
Question
Dariel, a forensic investigator, has been assigned to investigate a recent security incident that occurred within the organization's network. As part of the investigation, Dariel installs a command-line interface packet sniffer on a Unix-based system to monitor and capture network traffic, looking for signs of unauthorized access or malicious activity. The captured data will help Dariel identify the sources of the security breach and trace the attacker's actions through the network. The tool used must be efficient for analyzing real-time network traffic and capable of running on a Unix-based operating system. Which of the following tools did Dariel employ in the above scenario?
Options
- Atcpdump
- BMetashield Analyzer
- CTimestomp
- DBillboard
How the community answered
(41 responses)- A76% (31)
- B2% (1)
- C15% (6)
- D7% (3)
Explanation
According to the CHFI v11 curriculum under Network Forensics, investigators must be proficient in using packet sniffing tools to capture and analyze live network traffic. tcpdump is a widely used command-line packet analyzer that runs natively on Unix, Linux, and BSD-based systems. It allows investigators to capture packets in real time, apply powerful filters, and save traffic in PCAP format for further offline analysis using tools such as Wireshark. In forensic investigations, tcpdump is especially valuable because it provides low-level visibility into network communications, including source and destination IP addresses, ports, protocols, TCP flags, and payload data. This enables investigators to detect suspicious behaviors such as unauthorized connections, port scans, malware command-and-control traffic, data exfiltration attempts, and denial-of-service activities. CHFI v11 specifically highlights tcpdump as a core tool for network traffic investigation and evidence gathering in Unix-based environments.
Topics
Community Discussion
No community discussion yet for this question.