nerdexam
Cisco

210-250 · Question #133

Which options is true when using the traffic mirror feature in a switch?

The correct answer is D. full capture is possible. Switch port mirroring (SPAN) copies all frames from a source port or VLAN to a destination port without modifying them, enabling full packet capture.

Security Technologies

Question

Which options is true when using the traffic mirror feature in a switch?

Options

  • AEthernet headers are modified
  • Bpackets payloads are lost
  • Cpackets are not processed
  • Dfull capture is possible

How the community answered

(51 responses)
  • A
    2% (1)
  • B
    2% (1)
  • C
    2% (1)
  • D
    94% (48)

Why each option

Switch port mirroring (SPAN) copies all frames from a source port or VLAN to a destination port without modifying them, enabling full packet capture.

AEthernet headers are modified

Ethernet headers are preserved exactly as received; SPAN does not rewrite or modify any header fields.

Bpackets payloads are lost

Packet payloads are fully copied to the mirror port - no data is dropped or truncated during the mirroring process.

Cpackets are not processed

The original packets are still processed and forwarded normally on the source port; mirroring only adds a copy, it does not interrupt normal switching.

Dfull capture is possibleCorrect

SPAN/port mirroring duplicates every frame - including the complete Ethernet header and full payload - from the monitored port to a capture port. Because nothing is stripped or altered, a sensor or analyzer connected to the destination port can perform a complete, lossless packet capture of all traffic traversing the mirrored interface.

Concept tested: Switch port mirroring (SPAN) capabilities

Source: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html

Topics

#traffic mirroring#SPAN#packet capture#network monitoring

Community Discussion

No community discussion yet for this question.

Full 210-250 Practice