N10-005 · Question #351
An administrator has set up a NIPS and connected it to the same switch as the internal firewall interface and the internal router. The device, however, only detects traffic from itself to the…
The correct answer is B. Port Mirroring is set up incorrectly. By default, a managed switch only forwards frames to the port of the intended destination-it does not broadcast all traffic to every port. For a NIPS (Network Intrusion Prevention System) to inspect all traffic traversing the switch, port mirroring (also called SPAN-Switched…
Question
An administrator has set up a NIPS and connected it to the same switch as the internal firewall interface and the internal router. The device, however, only detects traffic from itself to the firewall or router. Which of the following explains why additional corporate traffic cannot be detected?
Options
- AThe spanning tree protocol is preventing the traffic.
- BPort Mirroring is set up incorrectly.
- CThe switch needs to be a layer 3 switch.
- DThe traffic is in a classless IP range and not classful IP range.
How the community answered
(30 responses)- A7% (2)
- B73% (22)
- C3% (1)
- D17% (5)
Explanation
By default, a managed switch only forwards frames to the port of the intended destination-it does not broadcast all traffic to every port. For a NIPS (Network Intrusion Prevention System) to inspect all traffic traversing the switch, port mirroring (also called SPAN-Switched Port Analyzer) must be configured to copy all switch traffic to the port where the NIPS is connected. If port mirroring is absent or misconfigured, the NIPS only sees traffic addressed directly to itself (unicast) or broadcast traffic, which explains the observed behavior. Spanning Tree Protocol prevents switching loops, not traffic visibility. A Layer 3 switch adds routing, which is unrelated to this issue. Classless vs. classful IP ranges do not affect switch port visibility.
Topics
Community Discussion
No community discussion yet for this question.