A network engineer wants to capture full packet data (PCAP) from a high-speed 10Gbps link. Which deployment method is preferred to avoid dropping packets?
Select an answer to reveal the explanation.
Short Explanation
You want a dedicated hardware network tap with a passive optical splitter feeding a high-performance capture appliance. It gives you lossless full-packet capture at wire speed without taxing the production link. The other methods either risk drops or don't capture full packets.
Full Explanation
A dedicated hardware network tap with a passive optical splitter feeding a high-performance capture appliance is preferred because hardware taps with passive optical splitters provide lossless packet capture at wire speed without affecting the monitored link, and high-performance capture appliances are built to handle 10Gbps+ rates. The software-based tap installed on the firewall as a plugin is wrong because software-based taps on firewalls consume firewall CPU resources and risk packet loss at high speeds. Port mirroring (SPAN) on the core switch with all VLANs mirrored to a single monitor port is wrong because SPAN ports on switches can drop packets when mirror traffic exceeds the monitor port bandwidth; a 10Gbps link mirrored to a single port may saturate it. Enabling NetFlow on the router and forwarding to a flow collector is wrong because NetFlow provides flow metadata, not full PCAP, and would be insufficient for deep packet inspection.