Which command-line tool serves as a packet analyzer similar to Wireshark?

Which command-line tool serves as a packet analyzer similar to Wireshark?

• A. Nmap
• B. Wireshark
• C. Netstat
• D. Tcpdump

Answer: (D)

Capturing and inspecting live network traffic from the command line is the core idea here. Tcpdump is designed for that purpose: it captures packets on a chosen interface and prints a readable summary of their headers (and can show payloads as well) directly in the terminal. It uses libpcap and supports filtering with Berkeley Packet Filter (BPF) syntax, so you can focus on just the traffic you care about, much like Wireshark does in GUI form, but in text mode. You can also save captures to a file (pcap) for later analysis with Wireshark. Nmap is a network scanner that identifies hosts and services, not a packet-by-packet analyzer. Netstat shows active connections and listening ports, not packet contents. Wireshark is the graphical packet analyzer, while tcpdump provides the same packet-capture capability from the command line. A quick usage example: sudo tcpdump -i eth0 -s 0 -nn -vv -w capture.pcap captures full packets on eth0 and writes them to a file for later examination.

Capturing and inspecting live network traffic from the command line is the core idea here. Tcpdump is designed for that purpose: it captures packets on a chosen interface and prints a readable summary of their headers (and can show payloads as well) directly in the terminal. It uses libpcap and supports filtering with Berkeley Packet Filter (BPF) syntax, so you can focus on just the traffic you care about, much like Wireshark does in GUI form, but in text mode. You can also save captures to a file (pcap) for later analysis with Wireshark.

Nmap is a network scanner that identifies hosts and services, not a packet-by-packet analyzer. Netstat shows active connections and listening ports, not packet contents. Wireshark is the graphical packet analyzer, while tcpdump provides the same packet-capture capability from the command line. A quick usage example: sudo tcpdump -i eth0 -s 0 -nn -vv -w capture.pcap captures full packets on eth0 and writes them to a file for later examination.