Which of the following methods can be used to detect session hijacking attack?

Nmap is a port scanner and network discovery tool, not designed to analyze session-layer traffic for hijacking indicators.

Brutus is a password brute-force tool used to crack authentication credentials, not to monitor or detect session hijacking.

Ntop is a network traffic usage and flow statistics monitor focused on bandwidth analysis, not on session-token level inspection required to detect hijacking.

A sniffer (packet analyzer) captures and inspects network traffic at the packet level, allowing an analyst to examine session tokens, cookies, and TCP sequence numbers in transit. By monitoring for duplicate session IDs or anomalous token reuse across different IP addresses, sniffers are a primary tool for detecting active session hijacking in progress.