A game studio must open one TCP handshake in a decoder. NetFlow on the Nexus leaf already shows the two addresses and the byte counts. Which tool supplies the frames themselves?
Select an answer to reveal the explanation.
Short Explanation
The turnstile count tells you how many people walked through, and it does not play the conversation. NetFlow already gave the studio the summary, so a SPAN session is what copies the frames an analyzer can open.
Full Explanation
NetFlow builds records of who talked, on which ports, and how many bytes moved. Those records do not include the handshake bytes a decoder needs. SPAN copies the frames from a source interface or VLAN to a destination where the analyzer sits, which is the capture the studio is missing. Stretching the NetFlow cache timeout keeps a flow record longer. It does not add a payload to the record. Streaming telemetry of interface counters pushes octet and packet totals. A counter is not a frame. A checkpoint diff shows how the command configuration drifted. It never saw this TCP handshake. Caveat: SPAN copies what crosses the source you named. If the handshake arrives on a different leaf or a different member of a port-channel than the one you spanned, the analyzer stays empty. Operational check: span the interface the server actually uses, reproduce the handshake, and open the capture before you change the NetFlow timers. Filter the SPAN source to the server interface that owns the handshake so the capture stays small enough to open, and stop the session when the decoder has the frames.