Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2VirtualizationMedium
A network operations team is managing a virtualized data center with numerous virtual machines. They need to analyze network traffic patterns and identify potential bottlenecks or security threats between VMs, even when they reside on the same physical host and communicate via the virtual switch. Which virtual switching feature enables the capture and analysis of this intra-host VM traffic?
- AMAC Address Learning
- BPort Mirroring (SPAN/RSPAN)
- CVLAN Tagging
- DLink Aggregation
Show answer & explanationAnswer & explanation
Correct answer: B. Port Mirroring (SPAN/RSPAN)
Port Mirroring (also known as SPAN on Cisco devices or RSPAN for remote mirroring) is a virtual switching feature that allows network administrators to copy traffic from one or more source ports (or VLANs) to a destination port for analysis. This is crucial in virtualized environments to capture and analyze intra-host VM traffic that would otherwise not leave the physical host, enabling troubleshooting, performance monitoring, and security analysis.
Why the other options are wrong
- A. MAC address learning is a basic function of a switch to build its forwarding table, not for traffic analysis.
- C. VLAN tagging segments traffic into different broadcast domains but does not capture it for analysis.
- D. Link aggregation combines multiple physical links for bandwidth and redundancy, not for traffic capture.
Virtual Switch Port Mirroring
A feature on virtual switches (like VMware vSwitch or Cisco Nexus 1000V) that duplicates network traffic from source ports/VLANs to a destination port for monitoring and analysis.
- Essential for troubleshooting and security analysis of intra-host VM traffic.
- Can mirror traffic from specific VMs, port groups, or uplinks.
- Often configured to send mirrored traffic to a virtual appliance for analysis (e.g., IDS/IPS).
Memory trick: Port Mirroring: See All Traffic Clearly.