What tool is used to observe and analyze the network traffic generated by malware?

What tool is used to observe and analyze the network traffic generated by malware?

• A. Registry/configuration tools
• B. HashMyFiles
• C. Network capture
• D. Log analyzers

Answer: (C)

Observing malware’s behavior on the network requires capturing the actual packets that travel between systems. A network capture tool records all traffic on a network interface, letting you inspect protocols, destinations, timing, and payloads. By running the malware in a sandbox and starting a capture, you can see who it talks to, what data is sent, and how the communications unfold. This direct view is essential for identifying command-and-control channels, data exfiltration, or unusual DNS lookups, and you can analyze the captured data with tools like Wireshark or tcpdump. Other options don’t fit as well because they don’t provide real-time visibility into network activity. Registry/configuration tools focus on local system settings, not network traffic. Hashing tools calculate file fingerprints, not traffic. Log analyzers depend on logs that may be incomplete or absent for live malware behavior, whereas network capture gives you the raw evidence of how the malware communicates.

Observing malware’s behavior on the network requires capturing the actual packets that travel between systems. A network capture tool records all traffic on a network interface, letting you inspect protocols, destinations, timing, and payloads. By running the malware in a sandbox and starting a capture, you can see who it talks to, what data is sent, and how the communications unfold. This direct view is essential for identifying command-and-control channels, data exfiltration, or unusual DNS lookups, and you can analyze the captured data with tools like Wireshark or tcpdump.

Other options don’t fit as well because they don’t provide real-time visibility into network activity. Registry/configuration tools focus on local system settings, not network traffic. Hashing tools calculate file fingerprints, not traffic. Log analyzers depend on logs that may be incomplete or absent for live malware behavior, whereas network capture gives you the raw evidence of how the malware communicates.