5.3 Perform Packet Capture and Analysis Using Wireshark, Tcpdump, SPAN, ERSPAN, and RSPAN CCIE-SECURITY Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   A network team wants to monitor traffic from a server connected to switch A. The monitoring station is connected to switch B, and switches A and B are connected via a trunk link. The team wants to use a switch-based mirroring solution that does not require IP routing. Which method should they choose?

   • AUse tcpdump on the server to capture traffic and send the file to the monitoring station.
   • BConfigure ERSPAN with a GRE tunnel between the switches.
   • CConfigure local SPAN on switch A and connect the monitoring station to a port on switch A.
   • DConfigure RSPAN with a dedicated VLAN between the switches.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst needs to capture traffic from a switch in a remote data center. The monitoring server is in a different data center, and the two are connected via a routed network. The analyst wants to use Wireshark on the monitoring server to analyze the traffic in real time. Which method should be used?

   • AConfigure ERSPAN on the remote switch to send encapsulated traffic to the monitoring server's IP address.
   • BConfigure RSPAN on the remote switch and extend the RSPAN VLAN over the routed network.
   • CUse tcpdump on the remote switch's management interface to capture traffic and send the file to the monitoring server.
   • DConfigure local SPAN on the remote switch and have someone connect a laptop to capture traffic.
   Reveal Solution Discussion Select an answer first