A junior systems administrator needs to make a packet capture file that will only capture HTTP protocol data to a file called test.pcap. Which of the following commands would allow the administrator…

`netcat` (nc) is a general-purpose networking utility for reading and writing data across network connections; it is not designed for promiscuous packet capturing and filtering like `tcpdump`.

`tshark -r test.pcap -o http` specifies reading packets *from* an existing file (`-r`) rather than capturing them live, and `-o http` sets a preference for HTTP dissection, not a capture filter.

`tcpdump -i eth0 port 80 -r test.pcap` incorrectly uses the `-r` option (read from file) with a capture interface (`-i eth0`) and a filter, preventing it from performing a live capture to a new file as requested.

The command `tcpdump -i eth0 port 80 -w test.pcap` correctly captures network traffic on the `eth0` interface, filters it to only include data on port `80` (HTTP), and writes all the captured packets to a file named `test.pcap`.