Which network protocol analyzer can be programmed to examine TCP headers to find the SYN flag?

• A. Wireshark
• B. Tethereal
• C. Tcpdump
• D. Fiddler

Answer: (B)

When you want to spot a specific flag in a protocol header, you need a tool that lets you programmatically access and inspect those header fields. Tethereal, the command-line counterpart to Ethereal (Wireshark), is designed for automation and scripting of how packets are parsed and what data you extract. You can easily target the TCP header and check the SYN bit, which is used to indicate the start of a TCP connection. This makes it a good fit for programmatically examining TCP headers to find the SYN flag, especially when you want to run filters or scripts without a graphical interface.

Wireshark also supports deep customization, but in the context of a test question about a programmable analyzer, the command-line tool that directly lends itself to scripted inspection of header fields is the intended choice. Tcpdump is excellent for real-time capture with filters, and Fiddler handles HTTP traffic, so they don’t focus on programmable examination of TCP header flags in the same way.