210-250 · Question #133
Which options is true when using the traffic mirror feature in a switch?
The correct answer is D. full capture is possible. Switch port mirroring (SPAN) copies all frames from a source port or VLAN to a destination port without modifying them, enabling full packet capture.
Question
Which options is true when using the traffic mirror feature in a switch?
Options
- AEthernet headers are modified
- Bpackets payloads are lost
- Cpackets are not processed
- Dfull capture is possible
How the community answered
(51 responses)- A2% (1)
- B2% (1)
- C2% (1)
- D94% (48)
Why each option
Switch port mirroring (SPAN) copies all frames from a source port or VLAN to a destination port without modifying them, enabling full packet capture.
Ethernet headers are preserved exactly as received; SPAN does not rewrite or modify any header fields.
Packet payloads are fully copied to the mirror port - no data is dropped or truncated during the mirroring process.
The original packets are still processed and forwarded normally on the source port; mirroring only adds a copy, it does not interrupt normal switching.
SPAN/port mirroring duplicates every frame - including the complete Ethernet header and full payload - from the monitored port to a capture port. Because nothing is stripped or altered, a sensor or analyzer connected to the destination port can perform a complete, lossless packet capture of all traffic traversing the mirrored interface.
Concept tested: Switch port mirroring (SPAN) capabilities
Source: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html
Topics
Community Discussion
No community discussion yet for this question.