Which statement about Scapy's packet capture methods is true?

• A. rdpcap() reads packets from a pcap file.
• B. sniff() reads from a capture file.
• C. wrppcap() captures live traffic.
• D. Wireshark must be invoked for any capture.

Answer: (B)

Scapy’s capture flow covers both live traffic capture and offline processing of saved captures. The function used for capturing on an interface is sniff, and it can also replay or analyze packets from a saved capture by using an offline source. That means sniff can read from a capture file when you pass an offline parameter pointing to a pcap, which is why the statement about reading from a capture file is true. This makes sniff versatile for both real-time analysis and offline review of traffic.

rdpcap reads packets from a pcap file, but it’s a separate helper for loading captured data rather than the live capture interface method. The function named wrpcap writes packets to a pcap file (the option with a misspelling isn’t correct). And you don’t need Wireshark to perform captures—Scapy can capture packets directly itself.