Tcpdump is a tool that can be used to detect which of the following indicators of compromise?

tcpdump is a command-line packet analyzer used for capturing and analyzing network traffic. Its primary function in a security context is to provide raw data for network forensics and incident response. By inspecting the contents, headers, sources, and destinations of packets, an analyst can identify anomalies that serve as Indicators of Compromise (IoC). These anomalies, such as traffic to or from known malicious IP addresses, data exfiltration patterns, command-and-control (C2) communications, or non-standard protocol usage, are collectively categorized as "unusual network traffic." Therefore, tcpdump is a fundamental tool for detecting this specific IoC.

B. tcpdump observes active traffic; it does not actively scan for open ports like tools such as nmap.
C. tcpdump can help diagnose the cause of poor performance (e.g., a flood), but it doesn't detect the performance issue itself.
D. While tcpdump can detect unknown protocols, this is a specific type of unusual network traffic, making option A more comprehensive. ---

1. Official Vendor Documentation: The official tcpdump man page describes its function as printing "a description of the contents of packets on a network interface." This capability is the foundation for observing traffic to identify any unusual or malicious activity.

Source: tcpdump(8) Linux manual page

available at tcpdump.org

Section: DESCRIPTION.

2. University Courseware: Course materials from reputable computer science programs demonstrate the use of tcpdump for security analysis. For example

labs often require students to analyze packet captures to find evidence of attacks

which constitutes identifying unusual network traffic.

Source: University of Washington

CSE 484 / CSE M 584: Computer Security

Lab 3: "Networking". The lab explicitly uses tcpdump and Wireshark to "examine network traffic to better understand how common network protocols work and see what information we can learn about network hosts." This analysis is key to finding anomalies.

3. Peer-reviewed Academic Publication: Academic literature on network forensics consistently identifies packet capture and analysis as a core methodology for detecting intrusions by identifying anomalous network traffic patterns.

Source: Al-Duwairi

B.

& Al-Karaki

J. (2011). A Network Forensic Analysis Tool for Tracking Intruders. International Journal of Computer Network and Information Security

3(1)

37-44. The paper discusses how packet capturing tools like tcpdump are essential for "collecting and analyzing network traffic data to detect security breaches" (Section 2.1

"Network Forensic Tools"). DOI: 10.5815/ijcnis.2011.01.05