nerdexam
EC-Council

312-50V10 · Question #799

Which of the following tools is used to analyze the files produced by several packet-capture programs such as tcpdump, WinDump, Wireshark, and EtherPeek?

The correct answer is A. tcptrace. tcptrace is a connection analysis tool specifically designed to parse and analyze packet capture files produced by tcpdump, WinDump, Wireshark, and EtherPeek.

Sniffing

Question

Which of the following tools is used to analyze the files produced by several packet-capture programs such as tcpdump, WinDump, Wireshark, and EtherPeek?

Options

  • Atcptrace
  • BNessus
  • COpenVAS
  • Dtcptraceroute

How the community answered

(46 responses)
  • A
    93% (43)
  • B
    2% (1)
  • D
    4% (2)

Why each option

tcptrace is a connection analysis tool specifically designed to parse and analyze packet capture files produced by tcpdump, WinDump, Wireshark, and EtherPeek.

AtcptraceCorrect

tcptrace reads capture files in formats produced by tcpdump, WinDump, Wireshark, and EtherPeek and performs detailed TCP connection analysis including throughput, RTT, retransmissions, and window sizes - making it purpose-built for post-capture file analysis across those specific formats.

BNessus

Nessus is a vulnerability assessment scanner that probes live systems for security weaknesses; it does not parse or analyze packet capture files.

COpenVAS

OpenVAS is an open-source vulnerability scanner used to identify security issues in network infrastructure; it does not process or analyze packet capture file formats.

Dtcptraceroute

tcptraceroute is a traceroute variant that uses TCP SYN packets to trace network paths to a live host; it does not analyze pre-recorded packet capture files.

Concept tested: Packet capture file analysis using tcptrace

Source: http://tcptrace.org/

Topics

#tcptrace#PCAP analysis#packet capture tools#traffic analysis

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice