210-250 · Question #142
Which option is true when using the traffic mirror feature in a switch?
The correct answer is A. Full packet captures are possible. Switch traffic mirroring (SPAN) copies full packets from a source port or VLAN to a destination port, enabling complete packet capture without modifying the original traffic.
Question
Which option is true when using the traffic mirror feature in a switch?
Options
- AFull packet captures are possible
- BPackets are automatically decrypted
- CEthernet header ate modified before capture
- DPacket payloads are lost
How the community answered
(38 responses)- A89% (34)
- B3% (1)
- C3% (1)
- D5% (2)
Why each option
Switch traffic mirroring (SPAN) copies full packets from a source port or VLAN to a destination port, enabling complete packet capture without modifying the original traffic.
Traffic mirroring via SPAN copies the complete original packet - including Ethernet header, IP header, transport header, and payload - to the monitor port, allowing a connected analyzer or IDS to perform full packet captures of all frames traversing the monitored port or VLAN.
Traffic mirroring is a passive copy mechanism with no cryptographic capabilities; encrypted frames such as TLS or MACsec remain encrypted in the mirror copy exactly as they appear on the wire.
Ethernet headers are not modified during mirroring - SPAN copies frames as-is, preserving all original header fields including source and destination MAC addresses.
Packet payloads are fully preserved in the mirrored copy; SPAN duplicates the entire frame, not just headers, which is what makes it useful for deep packet inspection.
Concept tested: Switch SPAN traffic mirroring capabilities
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/17-1/configuration_guide/nmgmt/b_171_nmgmt_9300_cg/configuring_span_and_rspan.html
Topics
Community Discussion
No community discussion yet for this question.