Ann a security analyst is monitoring the IDS console and noticed multiple connections from an internal host to a suspicious call back domain. Which of the following tools would aid her to decipher…

A vulnerability scanner identifies security weaknesses in systems and applications, not for real-time analysis or deciphering the content of ongoing network traffic.

NMAP is a network scanner primarily used for host discovery and port scanning, not for capturing and dissecting the content of network packets.

NETSTAT displays active network connections, routing tables, and interface statistics on a host, but it does not capture or analyze the actual data within the packets.

A packet analyzer, such as Wireshark, captures network traffic in real-time and dissects individual packets to reveal their headers and payloads. This allows Ann to examine the specific protocols, data content, and other characteristics of the suspicious communication to the callback domain, enabling a thorough understanding of the traffic.