Which of the following descriptions about the limitations of traditional traffic statistics is incorrect?

Question

Options

• AStatistics cannot be collected on flows other than ACL rules.
• BReal-time monitoring cannot be performed, and traffic cannot be mirrored, supporting equipment needs to be purchased for access, which is costly.
• CBased on IP packet counting, the statistical information is simple and cannot be counted on a variety of information.
• DTo implement flow statistics through the SNMP protocol, you need to continuously query the network management through polling, which wastes CPU and network resources.

• A
  81% (29)
• B
  3% (1)
• C
  11% (4)
• D
  6% (2)

Explanation

Option A is the incorrect description of a limitation because traditional traffic statistics are not restricted to ACL-rule-defined flows - interface-level counters, for example, capture all passing traffic regardless of any ACL configuration. Saying you can only collect stats on ACL-matched flows misrepresents how traditional statistics actually work.

Why the other options are genuine limitations:

• B is a real limitation: traditional statistics lack real-time granularity, and traffic mirroring (port mirroring/tapping) requires purchasing dedicated hardware, raising costs.
• C is a real limitation: traditional methods rely on basic IP packet/byte counting at the interface level, offering no breakdown by application, session, or other rich attributes.
• D is a real limitation: SNMP operates on a polling model - the network management system must repeatedly query devices, burning CPU cycles on both sides and consuming bandwidth.

Memory tip: Think of it as "ACL Alone = False." The word cannot in option A makes an overly restrictive claim. Traditional stats use broad interface counters - not just ACL buckets - so the supposed limitation in A simply doesn't exist, making it the odd one out.

No community discussion yet for this question.