Which Linux command-line packet capture tool captures and displays raw network traffic directly from the terminal?

Which Linux command-line packet capture tool captures and displays raw network traffic directly from the terminal?

• A. tcpdump
• B. Wireshark
• C. OTDR
• D. Cable Tester

Answer: (A)

This question is testing your knowledge of a command-line tool that pulls raw network traffic directly into the terminal. The best fit is tcpdump. It’s built specifically for live packet capture from a network interface and prints the raw packet data in a text form right in the terminal, making it ideal for quick inspection, scripting, and troubleshooting without any GUI. Tcpdump uses libpcap under the hood, which gives it robust, real-time access to packets and the ability to apply powerful filters (BPF) so you can focus on the traffic you care about. It can also read from saved capture files for later analysis, which is handy for post-incident reviews. The other options don’t match this use-case as cleanly. Wireshark is a comprehensive packet analyzer with a graphical interface; while it can capture and analyze traffic, its primary strength is its GUI, not a pure command-line, real-time terminal display. OTDR is a fiber-optic testing tool used to locate faults and characterize fiber links, not for capturing network packets. A cable tester is hardware-focused, used for verifying physical cabling continuity and performance, not for software-level packet capture. So, for capturing and displaying raw network traffic directly from the terminal, tcpdump is the right choice.

This question is testing your knowledge of a command-line tool that pulls raw network traffic directly into the terminal. The best fit is tcpdump. It’s built specifically for live packet capture from a network interface and prints the raw packet data in a text form right in the terminal, making it ideal for quick inspection, scripting, and troubleshooting without any GUI. Tcpdump uses libpcap under the hood, which gives it robust, real-time access to packets and the ability to apply powerful filters (BPF) so you can focus on the traffic you care about. It can also read from saved capture files for later analysis, which is handy for post-incident reviews.

The other options don’t match this use-case as cleanly. Wireshark is a comprehensive packet analyzer with a graphical interface; while it can capture and analyze traffic, its primary strength is its GUI, not a pure command-line, real-time terminal display. OTDR is a fiber-optic testing tool used to locate faults and characterize fiber links, not for capturing network packets. A cable tester is hardware-focused, used for verifying physical cabling continuity and performance, not for software-level packet capture. So, for capturing and displaying raw network traffic directly from the terminal, tcpdump is the right choice.