Which statement about wrppcap is correct?

• A. Writes packets to a pcap file
• B. Reads from a pcap file
• C. Captures live traffic
• D. Filters packets by protocol

Answer: (A)

wrppcap is used to write captured packets into a pcap file. It creates a file and records each packet with its metadata (like timestamps) in the standard pcap format, so you can reopen and analyze the data later. This is different from reading a pcap file, which would involve opening and parsing an existing file to retrieve packets. It's also separate from live capture, which grabs packets from a network interface in real time, and from filtering by protocol, which applies a filter to decide which packets to include or analyze rather than writing them to disk.