A company has a WLAN that uses Tunnel forwarding mode and WPA3-Enterprise security, supported by an Aruba Mobility Controller (MC) and campus APs (CAPs). You have been asked to capture packets from…

Question

Options

• AYou should use an Air Monitor (AM) to capture the packets in the air.
• BYou should capture the traffic on the MC dataplane to obtain unencrypted traffic.
• CYou should mirror traffic from the switch port that connects to the AP out on a port connected to a
• DYou should capture the traffic on the AP, so that the capture is as close to the source as possible.

• A
  78% (43)
• B
  4% (2)
• C
  5% (3)
• D
  13% (7)

Explanation

The correct approach for capturing packets from a wireless client in a WLAN that uses Tunnel forwarding mode and WPA3-Enterprise, managed by an Aruba Mobility Controller and Campus APs, is to use an Air Monitor (AM). An AM is specifically designed to capture wireless traffic "in the air," which means it listens to the wireless signals transmitted between devices and the access points. This method ensures that the capture includes all the necessary details while maintaining the integrity and security of the data as it is transmitted over the air. Using an Air Monitor helps in analyzing the raw wireless traffic before it gets encrypted or tunneled to the Mobility Controller, providing a clear view of the wireless client's activity and interactions. The information regarding the use of Air Monitors for packet capture in such environments can be found in the Aruba Network's official documentation and configuration guides for WLAN setups and security analysis.

No community discussion yet for this question.