Question

Compare and contrast the uses of NetWitness Investigator and Wireshark used in the lab. Why would a network administrator use Wireshark and NetWitness Investigator together?

Answer 1

Explanation:

Note, the Wireshark software application is unique in that it has the ability to perform multiple layers of individual packet analysis.

Whereas in NetWitness Investigator software application, even though it doesn't go deeper like Wireshark, it can still detect new threats or problems in a network and then organized all of such information for the administrator.

So, in a sense, by using both applications, a network administrator can find the problems (using Wireshark), while another application (NetWitness Investigator) organizes them for him.