CyberCertPrepNetwork FundamentalsSwitching & Routing BasicsEASYFree question
Scenario
A security team wants to capture all traffic between two servers (Server A and Server B) that are on the same switch, for analysis with Wireshark. The security analyst connects their laptop to the switch and runs Wireshark but only sees their own traffic.
What switch feature must be configured to allow the security analyst's laptop to receive copies of traffic between Server A and Server B?
- A.Enable promiscuous mode on the analyst's NIC
- B.Configure a SPAN port (Switched Port Analyzer / port mirroring): the switch copies frames from the source ports (Server A's port and Server B's port) and sends duplicates to the destination port (analyst's laptop port). The analyst can then capture all inter-server traffic in Wireshark
- C.Enable LLDP on the analyst's port to receive neighbor discovery frames
- D.Connect a hub between the two servers so all traffic is shared with every port, as an SVI is a physical routed port that cannot carry VLAN traffic. MAC learning is disabled on trunk ports, which rely on VLAN tags alone
Why B is correct