Which tool for this question

Open Wireshark when the question is still inside one capture and you need to click a field. The three panes show the frame, the decoded layers, and the bytes. Use it to follow one conversation and to see whether the payload is still readable.

Use tcpdump or tshark when you already know the question and want a print, not a window. tcpdump shows who sent the bytes and which flags came back. tshark reads the same file and pulls one field. Both live in the network workbench, next to the lessons on handing the file off.

Use Zeek when you want a log instead of another packet. conn.log, dns.log, and http.log answer who connected and what name was looked up, joined by one id. NetworkMiner is the host inventory of that same file. It is the wrong tool when you still need the bytes.

Open Burp when you need the history of what the lab browser sent, kept in a project, limited to the host that is in scope. The history is the list. Repeater is one request you already decided to send again. The proxy does not belong on a browser you use for anything else.

Open the browser Network panel when you are on the page and need the request it just made. The initiator column names the line that sent it. Preserve log keeps the row across a navigation. That is the page’s own record, not a second copy sitting in a proxy.

If the question is “what did we send,” start with the history. If the question is “what did this page do,” start with the panel. Both are in the web workbench.

Open Autopsy when the evidence is a disk. Files, names, hashes, and a timeline of what was saved are the questions it answers. A deleted name is still a name on the disk. The report is what a second reader can open.

Open Volatility when the evidence is a memory image. Processes, parents, command lines, and connections still sitting in RAM are the questions. A symbol table has to match the image or the plugins will lie. Nothing on that page asks you to run a program you found in the image.

Disk and memory answer different hours of the same case. If the machine is still on, memory is the part that goes away first. If you only have a copy of the drive, Autopsy is the tool that still has something to read.