Which statement correctly contrasts tcpdump and Wireshark?

• A. Tcpdump is a GUI-based tool.
• B. Wireshark uses port 123.
• C. Tcpdump is command-line only, while Wireshark offers a GUI.
• D. Both tools encrypt traffic.

Answer: (C)

The main idea here is how you interact with packet captures. Tcpdump runs in the command line, capturing packets and often printing a text summary to the terminal or saving to a file for later analysis. This makes it fast, scriptable, and handy for remote work. Wireshark, in contrast, provides a graphical user interface that lets you visually inspect packets, apply complex filters, colorize traffic, and drill down into protocol details with clicks. (There is a command-line counterpart called tshark, but the standard experience is GUI-based.) The other statements don’t fit: traffic ports aren’t dictated by the analyzer, and these tools don’t encrypt traffic—the encryption is about the data being transmitted, not about how the tools capture or display it.