Which statement correctly contrasts tcpdump and Wireshark?

Which statement correctly contrasts tcpdump and Wireshark?

• A. Tcpdump is a GUI-based tool.
• B. Wireshark uses port 123.
• C. Tcpdump is command-line only, while Wireshark offers a GUI.
• D. Both tools encrypt traffic.

Answer: (C)

The main idea here is how you interact with packet captures. Tcpdump runs in the command line, capturing packets and often printing a text summary to the terminal or saving to a file for later analysis. This makes it fast, scriptable, and handy for remote work. Wireshark, in contrast, provides a graphical user interface that lets you visually inspect packets, apply complex filters, colorize traffic, and drill down into protocol details with clicks. (There is a command-line counterpart called tshark, but the standard experience is GUI-based.) The other statements don’t fit: traffic ports aren’t dictated by the analyzer, and these tools don’t encrypt traffic—the encryption is about the data being transmitted, not about how the tools capture or display it.

The main idea here is how you interact with packet captures. Tcpdump runs in the command line, capturing packets and often printing a text summary to the terminal or saving to a file for later analysis. This makes it fast, scriptable, and handy for remote work. Wireshark, in contrast, provides a graphical user interface that lets you visually inspect packets, apply complex filters, colorize traffic, and drill down into protocol details with clicks. (There is a command-line counterpart called tshark, but the standard experience is GUI-based.) The other statements don’t fit: traffic ports aren’t dictated by the analyzer, and these tools don’t encrypt traffic—the encryption is about the data being transmitted, not about how the tools capture or display it.