Certified Incident Handler (CIH) Practice Ecam

Which tool did Harry use to analyze network traffic in his investigation?

1. Fiddler

2. Wireshark

3. Nmap

4. Netcat

The correct answer is: Wireshark

Wireshark is a widely recognized network protocol analyzer that allows users to capture and interactively browse the traffic running on a computer network. It provides detailed insights into the data packets being transmitted over a network, which is invaluable for analyzing traffic patterns, troubleshooting network issues, and identifying malicious activities. In an investigation, where understanding the specifics of the data communication is crucial, Wireshark would be the most effective choice, as it offers extensive filtering capabilities and the ability to analyze protocols at a granular level. While Fiddler is primarily used for HTTP/S traffic analysis and debugging, it is not as comprehensive as Wireshark for overall network traffic analysis. Nmap is more focused on network discovery and security auditing rather than deep packet inspection. Netcat, often referred to as a "Swiss army knife" for networking, lacks the sophisticated traffic analysis features provided by Wireshark. Hence, for a thorough examination of network traffic in an investigative context, Wireshark is definitely the most suitable tool.