Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2InfrastructureMedium
A network security team needs to monitor traffic traversing a critical server farm for anomalies and potential intrusions without impacting the performance of the production network devices. They require a solution that can copy traffic from multiple source ports to a dedicated analysis device. Which network monitoring feature is most suitable for this scenario?
- AEEM (Embedded Event Manager)
- BSPAN (Switched Port Analyzer)
- CSNMP
- DNetFlow
Show answer & explanationAnswer & explanation
Correct answer: B. SPAN (Switched Port Analyzer)
SPAN (Switched Port Analyzer) allows traffic from one or more source ports or VLANs to be copied to a destination port for analysis. This non-intrusive method is ideal for connecting an intrusion detection system (IDS) or packet analyzer to monitor traffic without affecting production network performance.
Why the other options are wrong
- A. EEM automates tasks and responds to events on a device, it's not a traffic monitoring feature.
- C. SNMP is used for polling device health and configuration, not for copying traffic for analysis.
- D. NetFlow provides flow statistics and metadata, not a full copy of the actual packet contents for deep inspection.
SPAN (Switched Port Analyzer)
A Cisco feature that allows traffic from one or more source ports or VLANs to be mirrored to a destination port for analysis.
- Used for network monitoring, intrusion detection, and troubleshooting.
- Non-intrusive; does not affect the forwarding of production traffic.
- Can monitor ingress, egress, or both directions of traffic.
Memory trick: Packet Analysis: SPAN the Traffic for a Deep Scan.