A network security analyst for a large company noticed unusual network activity on a critical system. Which of the following tools should the analyst use to analyze network traffic to search for malicious activity?

The analyst's goal is to perform a deep-dive analysis of unusual network traffic to identify potential malicious activity. Wireshark is a network protocol analyzer, also known as a packet sniffer. Its primary function is to capture network packets in real-time and display them in a human-readable format. This allows an analyst to inspect the contents of individual packets, reconstruct conversations between hosts, and identify anomalous or malicious patterns that would not be visible through other means. It is the most direct and appropriate tool for the specific task of analyzing network traffic.

A. WAF: A Web Application Firewall (WAF) is a security control that filters and monitors HTTP/S traffic to and from a web application; it is not a general-purpose network traffic analysis tool.
C. EDR: An Endpoint Detection and Response (EDR) tool focuses on monitoring and responding to threats on endpoints (e.g., workstations, servers), not on capturing and analyzing raw network-wide traffic.
D. Nmap: Nmap is a network scanner used for network discovery and security auditing. It actively sends packets to probe hosts, rather than passively capturing and analyzing existing traffic.

1. Wireshark Foundation. (n.d.). About Wireshark. Wireshark.org. Retrieved from https://www.wireshark.org/about.html. The official documentation states, "Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level..." This directly supports its use for traffic analysis.

2. Kurose, J. F., & Ross, K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 8, Section 8.8, "Network Security," the text discusses packet sniffers, stating, "A packet sniffer is a passive receiver that records a copy of every packet that passes by." This defines the exact function needed by the analyst.

3. OWASP Foundation. (n.d.). Web Application Firewall. OWASP.org. Retrieved from https://owasp.org/www-community/WebApplicationFirewall. This source defines a WAF as a control that "controls all the HTTP/S communication... in order to prevent attacks," distinguishing it from a passive analysis tool.

4. Lyon, G. (n.d.). What is Nmap?. Nmap.org. Retrieved from https://nmap.org/. The official Nmap documentation describes it as a "utility for network discovery and security auditing," a function distinct from analyzing existing traffic flows.

5. Souppaya, M., & Scarfone, K. (2013). Guide to Intrusion Detection and Prevention Systems (IDPS) (NIST Special Publication 800-94). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-94. Section 2.2.2, "Network Behavior Analysis," describes the analysis of network traffic to identify anomalies, a core capability provided by tools like Wireshark.