XK0-006 Troubleshooting Practice Question
A Linux server is experiencing intermittent network connectivity issues. The administrator needs to capture and analyze network traffic to diagnose the problem. Which TWO commands or tools can be used to capture packets on the eth0 interface? (Choose two.)
⚠ Common exam trap
Candidates often confuse interface statistics or connection listings with actual packet capture tools; only tcpdump and tshark capture and record packet data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
tcpdump -i eth0
tcpdump and tshark are both packet capture tools that can operate on a specified interface like eth0. They allow real-time capture and analysis of network traffic, which is essential for diagnosing intermittent connectivity issues. The other commands provide statistics or connection lists but do not capture packets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
tcpdump -i eth0
Why this is correct
tcpdump -i eth0 captures packets on the eth0 interface in real time. It is a standard command-line packet analyzer that allows filtering and inspection of network traffic. This directly addresses the need to capture packets for diagnosing intermittent connectivity issues. It provides detailed output that can be saved to a file for later analysis, making it a primary tool for network troubleshooting.
- ✗
netstat -i eth0
Why it's wrong here
netstat -i eth0 displays interface statistics such as packets received and transmitted, errors, and drops. It does not capture individual packets or provide payload inspection. While useful for checking interface health, it cannot capture traffic for deep analysis of intermittent connectivity problems, so it is not suitable for the task.
- ✓
tshark -i eth0
Why this is correct
tshark -i eth0 is the command-line version of Wireshark and captures packets on the eth0 interface. It offers extensive protocol decoding and filtering capabilities, making it suitable for detailed network analysis. Like tcpdump, it can capture live traffic and write to a file. It is a valid tool for capturing packets to diagnose intermittent connectivity issues.
- ✗
nmap -sP 192.168.1.0/24
Why it's wrong here
nmap -sP 192.168.1.0/24 performs a ping sweep to discover live hosts on a subnet. It sends ICMP echo requests and does not capture general network traffic. While it can help identify active hosts, it does not capture packets on eth0 for analysis of intermittent connectivity, making it unsuitable for this scenario.
- ✗
ss -t -a
Why it's wrong here
ss -t -a lists all TCP sockets and their states. It provides a snapshot of current connections but does not capture packets. It is useful for seeing listening ports and established connections, but it cannot record traffic over time or inspect packet contents, which is necessary for diagnosing intermittent connectivity issues.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 781 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.