A county courts site needs packet captures on a remote branch router where no SPAN destination switch exists. Which on-box approach best meets that need without hauling traffic to a distant analyzer?
Select an answer to reveal the explanation.
Short Explanation
When the courthouse branch has no SPAN destination, EPC is the on-router recorder. It catches matching packets into local buffers so ops can export a capture without inventing a fake mirror path across the WAN. Think dashcam on the car itself—not a camera bolted to a building miles away.
Full Explanation
Embedded Packet Capture lets IOS XE buffer selected traffic on the device that sees the flow, which is ideal when remote sites lack a SPAN destination or analyzers. Captures are defined with ACLs or other filters, stored in DRAM/file systems, and can be exported (for example via TFTP/SCP) for Wireshark analysis. RSPAN still needs topology that can deliver mirrored frames; WAN mirroring and disabling CEF are unsafe or impractical. EPC is the Domain 4 troubleshooting tool for on-box captures in civic edge sites.