A security team wants to capture all traffic between two servers (Server A and Server B) that are on the same switch, for analysis with Wireshark. The security analyst connects their laptop to the switch and runs Wireshark but only sees their own traffic.
What switch feature must be configured to allow the security analyst's laptop to receive copies of traffic between Server A and Server B?
- A.Enable promiscuous mode on the analyst's NIC
- B.Enable LLDP on the analyst's port to receive neighbor discovery frames
- C.Connect a hub between the two servers so all traffic is shared with every port
- D.Configure a SPAN port (Switched Port Analyzer / port mirroring): the switch copies frames from the source ports (Server A's port and Server B's port) and sends duplicates to the destination port (analyst's laptop port). The analyst can then capture all inter-server traffic in Wireshark
Why D is correct
On a switch, each port only receives traffic destined for MACs on that port - other traffic is not shared. A SPAN (Switched Port Analyzer) session or port mirroring sends copies of specified source port(s) traffic to a designated monitor port. Cisco: 'monitor session 1 source interface Gi0/1, Gi0/2; monitor session 1 destination interface Gi0/24'. The SPAN destination port receives a copy of ALL frames from the sources. Alternatives: a hardware network TAP (Test Access Point) passively copies traffic at the physical layer without affecting the network - preferred for high-reliability forensic capture.
Know someone studying for Network Fundamentals? Send them this one.