A network engineer wants to capture full packet data (PCAP) from a high-speed 10Gbps link. Which deployment method is preferred to avoid dropping packets?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because hardware taps with passive optical splitters provide lossless packet capture at wire speed without affecting the monitored link; high-performance capture appliances are built to handle 10Gbps+ rates. A is wrong because software-based taps on firewalls consume firewall CPU resources and risk packet loss at high speeds.
Full explanation below image
Full Explanation
B is correct because hardware taps with passive optical splitters provide lossless packet capture at wire speed without affecting the monitored link; high-performance capture appliances are built to handle 10Gbps+ rates. A is wrong because software-based taps on firewalls consume firewall CPU resources and risk packet loss at high speeds. C is wrong because SPAN ports on switches can drop packets when mirror traffic exceeds the monitor port bandwidth; a 10Gbps link mirrored to a single port may saturate it. D is wrong because NetFlow provides flow metadata (not full PCAP) and would be insufficient for deep packet inspection.