What is tcpdump used for?

• A. It graphs network traffic over time.
• B. It analyzes malware on hosts.
• C. It allows the user to display TCP/IP and other packets being transmitted or received over a network.
• D. It blocks unauthorized access.

Answer: (C)

tcpdump is a packet capture and display tool. It lets you see the actual frames traveling on a network interface, including TCP/IP headers and other protocol data, in real time or from a saved capture. This makes it invaluable for diagnosing connectivity issues, understanding traffic behavior, and investigating suspicious activity by inspecting exactly what packets are being transmitted or received. You can filter what you capture (for example, by host, port, or protocol) and save the results to a file for later analysis in a tool like Wireshark. It’s not a graphing utility, it doesn’t analyze malware on hosts, and it doesn’t block access—those are handled by other tools.