A security analyst is investigating an issue with a slow network segment and suspects suspicious activity. They find that a specific IP address is sending an unusually high volume of data. Which of the following tools would be BEST for the analyst to use to continue the investigation?