Which of the following is a passive device that views the current content of the packet traveling on the network?

A.
Protocol analyzer

B.
Spectrum analyzer

C.
WLAN controller

D.
Rogue AP

Explanation:
A protocol analyzer is a network diagnostic utility for viewing the current contents of a packet traveling on the network. Protocol analyzers are mainly used for performance measurement and troubleshooting. These devices connect to the network to calculate key performance indicators (KPI) to monitor the network and speed up troubleshooting activities. It is a passive device that captures 802.11 traffic and helps in detecting malicious eavesdropping attacks. It cannot be detected by a wireless intrusion detection system (WIDS). Answer option B is incorrect. A spectrum analyzer, or spectral analyzer, is a device that is used to examine the spectral composition of some electrical, acoustic, or optical waveform. It may also measure the power spectrum.
The analog and digital spectrum analyzers are as follows:
1.An analog spectrum analyzer uses either a variable band-pass filter whose mid-frequency is automatically tuned (shifted, swept)
through the range of frequencies of which the spectrum is to be measured. 2.A digital spectrum analyzer computes the discrete Fourier transform (DFT), a mathematical process that transforms a waveform into the components of its frequency spectrum.
Answer option C is incorrect. A wireless LAN controller is a device that is used in combination with Lightweight Access Point Protocol (LWAPP)
to manage light weight access points in large quantities by the network administrator or NOC. The Wireless LAN controller is part of the Data
Plane within the Cisco Wireless Model. The WLAN controller automatically handles the configuration of anywhere from 6 to 300 wireless
access-points, depending on the model.
Answer option D is incorrect. A Rogue access point (AP) is set up by the attackers in an Enterprise’s network. The attacker captures packets in
the existing wireless LAN (WLAN) and finds the SSID and security keys (by cracking). Then the attacker sets up his own AP using the same
SSID and security keys. The network clients unknowingly use this AP and the attacker captures their usernames and passwords. This can help the attacker to intrude the security and have access to the Enterprise data.