Matt, an administrator, notices a flood fragmented packet and retransmits from an email server. After disabling the TCP offload setting on the NIC, Matt sees normal traffic with packets flowing in seq

A spam filter inspects email message content and metadata to block unsolicited mail and does not provide visibility into raw network packet behavior.

A protocol analyzer (such as Wireshark) captures all packets traversing a network interface and displays them with full header detail, including TCP sequence numbers, fragment flags, and retransmission events. This is the only tool listed that would allow Matt to observe fragmented packets and confirm that disabling TCP offload restored normal sequential packet flow.

A web application firewall inspects and filters HTTP/HTTPS application traffic for web-layer attacks and does not capture or display packet-level fragmentation data.

A load balancer distributes incoming traffic across multiple backend servers for availability and performance and does not capture or analyze individual packet sequences.