Police HQ needs a packet analyzer to see traffic from one switch access port that serves an evidence-intake workstation, and both the source port and the analyzer attach to the same switch. Which capture method fits that requirement?
Select an answer to reveal the explanation.
Short Explanation
Same switch, one port to watch, analyzer plugged in nearby—that is classic local SPAN. You are just holding up a mirror on that closet switch, not hauling mirrored frames across the city.
Full Explanation
Police HQ needs a packet analyzer to observe traffic from one switch access port serving an evidence-intake workstation, and both the source and the analyzer attach to the same switch. Local SPAN is the purpose-built answer: it mirrors frames from the source port to a destination port on that same switch so the analyzer receives a copy without traversing the campus core or requiring GRE encapsulation. That keeps the capture path short, local, and aligned with a single-closet investigative need.
RSPAN using a dedicated VLAN carried across the campus core fails by concept for this stem: RSPAN is designed when the analyzer is on a different switch and mirrored frames must ride an RSPAN VLAN across Layer-2. Here both ports share one switch, so introducing a core-wide RSPAN VLAN adds unnecessary complexity and blast radius. ERSPAN encapsulating mirrored frames in GRE to a remote IP analyzer targets Layer-3 delivery to a distant analyzer; it is overkill and the wrong topology when the analyzer is already local. IP SLA ICMP echo toward the workstation cannot reconstruct full packet payloads—IP SLA measures probe success, latency, or related metrics; it is not a mirror technology and does not deliver application payloads to a packet analyzer.
Exam caveat: match SPAN family to topology—local SPAN same switch, RSPAN remote L2 via RSPAN VLAN, ERSPAN remote L3 via GRE/IP. Do not substitute reachability probes (IP SLA) for packet capture requirements.
Operational check at Police HQ: configure a local SPAN session sourcing the evidence-intake access port and destinating the analyzer port on the same switch, then confirm the analyzer sees mirrored frames while verifying the destination port is not used for normal forwarding and is not oversubscribed during peaks.