Users are reporting a large decrease in network performance. After further investigation, the network administrator notices large amounts of traffic coming from a specific IP address. The network…

ipconfig displays local IP configuration information such as IP address, subnet mask, and gateway - it does not capture or analyze live network traffic.

ping sends ICMP echo requests to test reachability and measure round-trip latency; it provides no visibility into payload content.

A network sniffer (such as Wireshark) captures packets at the wire level and decodes each layer, including the payload data. This allows the administrator to inspect the actual content of traffic from the suspicious IP address and determine its nature.

route displays or modifies the local IP routing table; it does not capture or inspect traffic payloads.