Which tool has the capability to capture the TCP handshake and display it for analysis?

Which tool has the capability to capture the TCP handshake and display it for analysis?

• A. Port Scanner
• B. Firewall
• C. Load Balancer
• D. Protocol/Packet Analyzer

Answer: (D)

Capturing and analyzing raw network traffic, especially the TCP handshake, is what a protocol/packet analyzer is built to do. It can attach to a network interface, capture the frames as they occur, and present them in a readable, protocol-aware format. For the TCP handshake, you can clearly see the sequence where the client sends a SYN, the server replies with a SYN-ACK, and the client completes with an ACK. The tool displays vital details like source and destination IPs and ports, TCP flags, sequence and acknowledgment numbers, and timing, which helps you verify that the handshake completes correctly and diagnose issues like delays, retransmissions, or dropped packets. You can filter to just the handshake packets, follow the TCP stream, and even watch how the connection progresses into the actual data transfer. The other options don’t fit because a port scanner probes and reports on open ports without capturing or analyzing ongoing traffic; a firewall focuses on filtering and logging rather than presenting live packet details for analysis; and a load balancer distributes connections rather than serving as a primary traffic capture/analysis tool.

Capturing and analyzing raw network traffic, especially the TCP handshake, is what a protocol/packet analyzer is built to do. It can attach to a network interface, capture the frames as they occur, and present them in a readable, protocol-aware format. For the TCP handshake, you can clearly see the sequence where the client sends a SYN, the server replies with a SYN-ACK, and the client completes with an ACK. The tool displays vital details like source and destination IPs and ports, TCP flags, sequence and acknowledgment numbers, and timing, which helps you verify that the handshake completes correctly and diagnose issues like delays, retransmissions, or dropped packets. You can filter to just the handshake packets, follow the TCP stream, and even watch how the connection progresses into the actual data transfer. The other options don’t fit because a port scanner probes and reports on open ports without capturing or analyzing ongoing traffic; a firewall focuses on filtering and logging rather than presenting live packet details for analysis; and a load balancer distributes connections rather than serving as a primary traffic capture/analysis tool.