Which tool would Allen most likely select to perform network intrusion prevention, intrusion detection, packet capture, and traffic monitoring?

Which tool would Allen most likely select to perform network intrusion prevention, intrusion detection, packet capture, and traffic monitoring?

• A. Wireshark
• B. Snort
• C. Nessus
• D. Metasploit

Answer: (B)

Snort is designed to function as both a network intrusion detection system (IDS) and a network intrusion prevention system (IPS). It analyzes traffic in real time using a rule set to identify malicious patterns, so in IDS mode it generates alerts, and in inline IPS mode it can block or drop offending packets. It also provides visibility through logging and traffic monitoring as it inspects each packet, effectively handling packet capture and ongoing traffic analysis. Wireshark focuses on packet capture and deep inspection but doesn’t offer real-time intrusion prevention; Nessus is a vulnerability scanner, not a monitoring/IPS tool; Metasploit is an exploitation framework. So Snort best covers all four requirements.

Snort is designed to function as both a network intrusion detection system (IDS) and a network intrusion prevention system (IPS). It analyzes traffic in real time using a rule set to identify malicious patterns, so in IDS mode it generates alerts, and in inline IPS mode it can block or drop offending packets. It also provides visibility through logging and traffic monitoring as it inspects each packet, effectively handling packet capture and ongoing traffic analysis. Wireshark focuses on packet capture and deep inspection but doesn’t offer real-time intrusion prevention; Nessus is a vulnerability scanner, not a monitoring/IPS tool; Metasploit is an exploitation framework. So Snort best covers all four requirements.