A user reports network performance issues when accessing a specific server.

Packet capture is the best tool for identifying the cause of a network issue in real time. A packet capture allows a technician or administrator to inspect live network traffic between the client and server. It can reveal retransmissions, dropped connections, DNS problems, TCP handshake failures, latency symptoms, protocol errors, authentication issues, and application-level communication problems. This aligns with the CompTIA Network+ N10-009 troubleshooting objectives, which include using appropriate tools to diagnose network performance and connectivity issues.

Port mirroring can be useful, but it is a switch feature that copies traffic from one port or VLAN to another monitoring port. It helps collect traffic, but by itself it does not analyze the packets. A packet capture tool is what actually records and inspects the traffic. Syslog reports are valuable for reviewing device logs, but they may not show real-time packet-level behavior between the user and the server. Baseline metrics are useful for comparison against normal performance, but they do not directly identify the immediate cause of a live issue. Therefore, packet capture is the most appropriate answer.