Protocol Analyzer
Software that captures and inspects packets to diagnose traffic and protocol problems.
A protocol analyzer (packet sniffer) captures raw frames off the wire and decodes every layer of the stack — Ethernet headers, IP addresses, TCP flags, application payloads — making it the strongest tool for diagnosing intermittent faults, misconfigured protocols, and unexpected traffic. Wireshark is the canonical open-source example in Network+ objectives. The key exam distinction is from a port scanner: a scanner probes which services are listening, while an analyzer passively captures live traffic. Because a switch forwards frames only to their destination port, capturing beyond your own host needs a mirror or SPAN port; otherwise you see only broadcast, multicast, and your own MAC’s frames.
PlayPrepHQ study notes are written and reviewed against primary exam sources. How we create & review content →