A national retailer wants the busiest host pairs and their byte counts on one VLAN for a business day, without copying every frame to an analyzer. Which record should be collected?
Select an answer to reveal the explanation.
Short Explanation
You asked for the day's sales totals, not a photograph of every coin. You collect a NetFlow record so the switch reports the conversations and the byte counts on that VLAN. A SPAN session hands you the frames themselves, and it is the wrong tool once you have said you do not want that copy.
Full Explanation
NetFlow on NX-OS records flows: who talked to whom, on which ports, and how many bytes moved. That is the summary this retailer wants for a business day, and it does not require copying every frame to an analyzer. SPAN is the frame-copy tool. A session to a laptop gives a packet capture, not a built-in top-talker summary that avoids retaining the packets. A configuration checkpoint is a snapshot of the configuration. Saving it does not count traffic, and it has no record of host pairs. An EEM applet can react to a syslog message and run a command. It does not sit on the VLAN and produce a flow record, and a syslog line about the VLAN is not a byte count. Caveat: the flow record has to include the fields you care about and be exported or viewed for the full day, or a short cache timeout can age the busy pairs out before you look. Operational check: enable the flow record on the VLAN, let it run through a busy period, and confirm the top conversations show byte counts without a SPAN destination in the path.