An engineer is investigating a case of the unauthorized usage of the “Tcpdump” tool.

 The unauthorized usage of “Tcpdump” tool indicates that the malicious insider was attempting to obtain all information within datagrams passing through a specific interface on the network. Tcpdump allows users to capture packet data from a live network or read packets from a previously saved capture file. References := Cisco CyberOps - Module 3: Network Data and Event Analysis