Which networking device commonly supports traffic monitoring features such as…

2024

Which networking device commonly supports traffic monitoring features such as port mirroring, enabling packet analyzers operating in promiscuous mode to inspect network traffic?

  1. A.

    Repeater

  2. B.

    Hub

  3. C.

    Switch

  4. D.

    Bridge

  5. E.

    Router

Attempted by 82 students.

Show answer & explanation

Correct answer: C

Correct answer: Switch.

A modern (managed) network switch operates at the data link layer and learns the MAC addresses of connected devices, so by default it forwards each frame only to the single port leading to the destination. This selective forwarding means a packet analyzer attached to an ordinary switch port would normally see only its own traffic, not the whole segment.

To make full traffic visible for monitoring, managed switches provide a port mirroring feature (called SPAN — Switched Port Analyzer — on Cisco devices). Port mirroring copies the frames seen on one or more source ports (or an entire VLAN) to a designated monitor port. A packet analyzer such as Wireshark, connected to that monitor port and running its NIC in promiscuous mode, can then capture and inspect all the mirrored traffic.

Therefore, the device that commonly supports port mirroring for traffic monitoring is the Switch.

Explore the full course: Niacl Ao It Specialist