Question

which of the following correctly differentiates between tcpreplay and tcpdump?
tcpdump is a packet capture tool with gui, whereas tcpreplay is a packet capture tool without gui.
tcpdump is a packet capture tool without gui, whereas tcpreplay is a packet capture tool with gui.
tcpdump can only be used to analyze the packets, whereas tcpreplay can analyze, edit, and load the edited packet back to the network.
tcpdump can analyze, edit, and load the edited packet back to the network, whereas tcpreplay can only be used to analyze the packets.
question 26
2 pts
which monitoring methodology will trigger the ids if any application tries to scan multiple ports?
signature - based monitoring
heuristic monitoring
anomaly - based monitoring
behavior - based monitoring

Explanation:

Tcpdump is a command - line (no GUI) packet capture and analysis tool. Tcpreplay can analyze, edit packets and send the edited packets back to the network. For IDS, anomaly - based monitoring triggers on abnormal behavior like multiple port scanning as it looks for deviations from normal patterns.

Answer:

For the first question: Tcpdump can only be used to analyze the packets, whereas Tcpreplay can analyze, edit, and load the edited packet back to the network.
For the second question: Anomaly - based monitoring