Users at a university are experiencing slow response and performance issues with private cloud services. The university was compromised, and a loss of bandwidth utilization was reported. Without…

Correlating logs in an event management system identifies historical patterns but does not provide real-time packet-level visibility into which traffic types are actively consuming bandwidth during the current incident.

Replacing load balancers with CDN hardware is a mitigation or infrastructure change, not a diagnostic step, and does not reveal the root cause of the bandwidth loss.

Capturing network traffic using sniffing capabilities already present on systems (such as built-in utilities like tcpdump or existing network taps) allows the administrator to identify the source, destination, protocol, and volume of traffic consuming bandwidth. This reveals whether the bandwidth loss stems from a DDoS attack, unauthorized data exfiltration, misconfigured services, or other anomalous traffic - information that log correlation alone cannot provide with the same precision. Traffic capture gives actionable, packet-level evidence of the root cause.

Deploying an antivirus solution requires installing new software, which the question explicitly prohibits, and antivirus tools do not directly measure or catalog bandwidth consumption by traffic type.