The help desk is receiving reports of intermittent connections to a server. A help desk technician suspects the server is unable to establish a three-way handshake due to a DoS attack. Which of the following commands should a network administrator use to confirm the help desk technician's claim?
A) nmap
B) arp
C) tcpdump
D) dig

Question

Quizplus · Accepted Answer

Tcpdump is a network packet analyzer that can capture and display the traffic on a network. It can be used to analyze the traffic to and from the server to confirm if there are numerous incomplete TCP handshakes, which would indicate a potential DoS attack.

The Help Desk Is Receiving Reports of Intermittent Connections to a Server