Question

Marissa wants to perform network forensics using a Linux system and wants to use a
built-in, command line tool. What tool should she select?
Group of answer choices

tcpdump

dd

Wireshark

netcap

Answer 1

For network forensics using a command line tool on a Linux system, Marissa should select **tcpdump**.

Tcpdump is a powerful command-line packet analyzer that allows users to capture and display the packets being transmitted or received over a network interface. It is widely used for network troubleshooting, analysis, and forensics.

While Wireshark is a popular network analysis tool, it typically has a graphical user interface (GUI) and can be cumbersome for command line usage. The other options, dd and netcap, are less suitable for network forensics in this context.

So, the best choice is **tcpdump**.