Which of the following tools should the administrator use to detect this attack?