A county courts site needs packet captures on a remote branch router where no SPAN destination switch exists. Which on-box approach best meets that need without hauling traffic to a distant analyzer?
Select an answer to reveal the explanation.
Short Explanation
When the courthouse branch has no SPAN destination, EPC is the on-router recorder. It catches matching packets into local buffers so ops can export a capture without inventing a fake mirror path across the WAN. Think dashcam on the car itself—not a camera bolted to a building miles away.
Full Explanation
County courts often need packet captures on a remote branch router where no SPAN destination switch exists and hauling mirrors across the WAN is undesirable. Embedded Packet Capture (EPC) on the remote IOS XE router buffers matching flows locally for export or review, giving on-box capture without a remote analyzer path. That approach fits branch constraints while still producing usable PCAP evidence for intermittent issues.
Enabling RSPAN toward the courthouse core fails when the remote closet has no SPAN-capable destination and misunderstands EPC’s local buffering role. Mirroring every interface to the WAN uplink so the NOC can sniff over the Internet wastes bandwidth and may expose traffic. Disabling CEF so every packet is process-switched into the console buffer is operationally dangerous and is not a capture architecture.
Exam caveat: EPC filters, buffer size, and export method must be scoped tightly on busy routers or the capture itself becomes the outage. Operational check: define a precise EPC ACL for the suspect 5-tuple on the branch router, reproduce the issue, export the buffer, and confirm the frames of interest are present before clearing the capture. In municipal court operations, attach the PCAP hash and filter definition to the ticket so evidence handling remains auditable.