During an investigation, you are asked to verify whether a Red Hat Enterprise Linux 9 application server is sending unauthorized outbound traffic on TCP port 4444. The system must stay in production and you cannot add or remove software, but you do have root access. Which built-in security tool is the most appropriate for capturing live packets on the network interface and writing them to a .pcap file for later forensic analysis?
The packet-capture utility tcpdump is included in most Linux distributions by default and can record traffic directly from an interface (for example, "tcpdump -i eth0 -w suspect.pcap"). This satisfies the requirement to capture and store raw packets without installing extra software. nmap is a port scanner that probes hosts and ports but does not capture packets. clamscan is an on-demand antivirus scanner that scans files for malware, not network traffic. chkconfig (or its systemd equivalent) only enables or disables services at specific runlevels and offers no packet-capture capability.