312-50V10 · Question #317
When using Wireshark to acquire packet capture on a network, which device would enable the capture of all traffic on the wire?
The correct answer is A. Network tap. A network tap is a hardware device that passively copies all traffic on a network segment, enabling Wireshark to capture every packet on the wire without affecting network performance.
Question
When using Wireshark to acquire packet capture on a network, which device would enable the capture of all traffic on the wire?
Options
- ANetwork tap
- BLayer 3 switch
- CNetwork bridge
- DApplication firewall
How the community answered
(44 responses)- A93% (41)
- C2% (1)
- D5% (2)
Why each option
A network tap is a hardware device that passively copies all traffic on a network segment, enabling Wireshark to capture every packet on the wire without affecting network performance.
A network tap (Test Access Point) is a passive hardware device inserted inline on a network link that creates an exact copy of all traffic passing through it and forwards that copy to a monitoring port. This allows Wireshark to capture 100% of traffic on the wire, including traffic not destined for the capture host, without requiring promiscuous mode on a shared medium.
A Layer 3 switch routes traffic based on IP addresses and only forwards packets to their destination port, so a connected monitor would only see broadcast traffic and traffic addressed to it.
A network bridge connects two network segments at Layer 2 but does not inherently mirror all traffic to a capture device; it forwards frames based on MAC address tables.
An application firewall filters and inspects traffic based on application-layer rules and does not provide passive full-wire packet capture to an external monitoring tool.
Concept tested: Network tap usage for full-wire packet capture
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChCapCaptureFilterSection.html
Topics
Community Discussion
No community discussion yet for this question.