Question

Marissa wants to perform network forensics using a Linux system and wants to use a built-in, command line tool. What tool should she select?
Group of answer choices

netcap

tcpdump

Wireshark

dd

Answer 1

For network forensics using a Linux system with a built-in command line tool, Marissa should select **tcpdump**.

- **tcpdump** is a powerful command-line packet analyzer that can capture and display network traffic.
- **Wireshark** is a more feature-rich graphical tool for analyzing network traffic, but it is not a built-in command-line tool.
- **netcap** is not a standard or commonly used tool in Linux.
- **dd** is a command-line utility for converting and copying files but is not specifically for network traffic analysis.

Therefore, **tcpdump** is the best choice for her needs.