A municipal playbook prefers writing PCAP to disk during Wi-Fi surveys. What is the primary evidence benefit?
Select an answer to reveal the explanation.
Short Explanation
Live terminals vanish; PCAPs stick around. Save the capture so analysis and the report have something stronger than a screenshot of scrolling green text.
Full Explanation
Writing PCAP to disk during municipal Wi-Fi surveys preserves recon evidence for later analysis and reporting beyond what a live terminal scroll can retain. Binary captures let civic teams reopen frames in Wireshark, prove handshake completeness, and attach hash-verified artifacts to the engagement record. Live output is ephemeral; PCAPs are the durable evidence substrate. Saying PCAPs permanently disable neighboring SSIDs fails by concept: capturing files does not silence other networks. Claiming disk captures automatically forge client certificates for Enterprise evil-twin testing fails by concept: PCAPs store observed frames; they do not mint certificates. Asserting that writing PCAP removes the legal need for RoE because files are archival fails by concept: evidence format never replaces authorization to collect RF data. Exam caveat: store captures with engagement labels and access controls—municipal PCAPs can contain privacy-sensitive probe data even when testing stays passive. Operational check: configure airodump-ng or equivalent to write a named pcap/cap under the city evidence path, verify the file grows during survey, compute a hash for chain-of-custody, and archive it with the report package.