A plant's Threat Defense appliance drops packets from a legacy SCADA polling tool, yet it raises no alerts and writes no matching connection event. The engineer needs the live Snort decision for each individual packet. Which troubleshooting tool should the engineer use to capture the per-packet verdicts?

Enabling the system support trace is the appropriate choice because it records Snort’s live verdict for each matching packet, providing the packet-level decision the engineer needs even when the appliance produces no alert or connection event. A live ingress-and-egress capture is a useful way to confirm that frames arrive and do not leave, and header and timing correlation can help locate the loss; however, it observes traffic at interfaces rather than exposing Snort’s verdict, so it cannot establish which inspection decision caused a particular packet’s treatment. Per-rule hit counters can show whether signatures are being exercised during a polling cycle and help narrow a rule-related investigation, but they aggregate activity rather than associating a live verdict with each individual packet. A policy-simulator replay can clarify how a representative packet is expected to traverse inspection and what disposition the policy predicts, but a replay is not the appliance’s live decision on each packet in the actual exchange. Exam caveat: captures, counters, simulations, and diagnostic traces answer different questions; evidence of a drop or a rule hit is not equivalent to a per-packet Snort verdict. Practical check: generate a controlled polling exchange, enable the support trace for the relevant traffic, and correlate its packet-level verdicts with timestamps and the appliance’s interface captures.