Which of the following methods can be used to detect session hijacking attack?

ntop is a passive network traffic statistics and monitoring tool used for bandwidth analysis, not for inspecting session-level anomalies like hijacked TCP streams.

Brutus is an online password brute-force tool used to crack authentication credentials, and has no capability to analyze or detect session hijacking.

nmap is a network discovery and port-scanning tool, not a live traffic monitor capable of detecting session-level anomalies.

A packet sniffer captures all traffic on a network segment, allowing an analyst to inspect TCP sequence numbers, session cookies, and source IP changes mid-session - all key indicators of a session hijacking attack. By analyzing this traffic in real time or offline, discrepancies such as duplicate sequence numbers or sudden IP address changes reveal that an attacker has taken over an established session.