An IDS alert is sent to the server administrator indicating an unauthorized access attempt is occurring against a secure file server on the network. Which of the following tools will BEST help…

A protocol analyzer (such as Wireshark) captures raw network traffic in real time, enabling the administrator to inspect the packets targeting the file server and confirm whether malicious or unauthorized activity is actually occurring. It provides the deepest level of network visibility for validating IDS alerts by showing source IPs, protocols, payloads, and session behavior. This directly correlates with what the IDS detected, confirming or dismissing the alert with evidence.

A port scanner identifies open ports on a target system but does not capture live traffic or confirm whether an access attempt is actively occurring.

An anti-malware scan checks the server for malicious software already present but cannot confirm an active network-based unauthorized access attempt in progress.

MD5 checksum analysis verifies file integrity to detect tampering after the fact but does not provide visibility into live network access attempts.