Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2InfrastructureEasy
A network security team needs to monitor incoming and outgoing traffic on a critical server connected to a Catalyst 9300 switch. The team wants to capture all traffic from the server's interface and send it to an intrusion detection system (IDS) connected to another port on the same switch without affecting the server's performance. Which feature should the engineer configure?
- ANetFlow
- BRSPAN
- CSPAN
- DERSPAN
Show answer & explanationAnswer & explanation
Correct answer: C. SPAN
SPAN (Switched Port Analyzer) allows traffic mirroring from one or more source ports or VLANs to a destination port on the same switch. This is suitable for monitoring local traffic on a critical server and sending it to an IDS also connected to the same switch.
Why the other options are wrong
- A. NetFlow collects IP flow statistics, not full packet captures, and is used for traffic analysis rather than direct packet inspection by an IDS.
- B. RSPAN (Remote SPAN) is used to monitor traffic across multiple switches in a Layer 2 domain, which is not required as the IDS is on the same switch.
- D. ERSPAN (Encapsulated Remote SPAN) is used to monitor traffic across Layer 3 boundaries, which is also not required as the IDS is on the same switch.
SPAN (Switched Port Analyzer)
A Cisco feature that duplicates packets from one or more source ports or VLANs to a destination port on the same switch for analysis.
- Local traffic mirroring on a single switch.
- Non-intrusive monitoring.
- Often used for network analyzers or IDS/IPS.
- Does not forward mirrored traffic out of the switch by default.
Memory trick: Monitoring: Many ways to see network traffic.