A security administrator is investigating strange network behavior on a single VLAN that is used only by vendors. Which of the following tools would BEST allow the administrator to look at network…

A port scanner probes hosts to identify open ports and services but does not capture or analyze the content of network packets.

A cipher is a cryptographic algorithm used for encrypting or decrypting data, not a network traffic capture or monitoring tool.

A network sniffer such as Wireshark or tcpdump captures raw frames and decodes packet headers, payloads, protocols, and source/destination addresses in real time. This deep packet inspection capability allows an administrator to pinpoint anomalous communication patterns within a specific VLAN segment. Capture filters can be scoped to the vendor VLAN, providing focused, granular visibility into suspicious traffic.

A checksum is a mathematical value used to verify data integrity, not an instrument for capturing or examining network traffic.