220-1101 Question 175
Single answerNetwork tapA technician is troubleshooting intermittent packet loss between a file server and a core switch. The network administrator wants the technician to capture all traffic on that link for analysis without changing switch settings or risking disruption to production traffic. Which solution should the technician use?
- A
Install a network tap between the file server and the switch, and connect the analyzer to the tap's monitoring interface
- B
Replace the Ethernet patch cable with a rollover cable so the analyzer can read management traffic directly
- C
Connect the analyzer to the router's console port and capture the packets from the serial session
- D
Insert an unmanaged switch between the file server and the core switch so broadcast traffic can be viewed from any port
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a network tap. In real-world troubleshooting, a tap allows a technician to observe traffic on a link by creating a copy for analysis while leaving the original communication path intact. This is especially useful when administrators do not want to alter switch configuration or rely on port mirroring. Industry best practice is to use passive monitoring methods when capturing packets on critical production links, and network taps are specifically built for that purpose. By contrast, console connections and rollover cables are for device management, not traffic capture, and adding an unmanaged switch does not guarantee visibility into all packets on a switched Ethernet network.
- A. Correct.
Correct. A network tap is designed to provide a passive copy of traffic flowing across a network link to a monitoring device such as a protocol analyzer. This is appropriate when the goal is to capture traffic without reconfiguring the production switch, such as enabling SPAN or port mirroring. Taps are commonly used for troubleshooting and monitoring because they minimize impact on the live connection.
- B. Incorrect.
Incorrect. A rollover cable is used to connect a computer or terminal to a network device's console port for local management access. It does not sit inline on an Ethernet data link and cannot be used to capture normal production packets between a server and switch.
- C. Incorrect.
Incorrect. A router console port provides command-line management access, not packet capture of transit Ethernet traffic. Someone might choose this option because console access is associated with diagnostics, but it is not used to monitor live data frames crossing a server-to-switch link.
- D. Incorrect.
Incorrect. An unmanaged switch is not a proper substitute for a network tap. Modern switches forward unicast traffic only to the destination port, so a packet analyzer connected to another port will not reliably see all traffic. Inserting another switch also changes the network path and could introduce additional variables during troubleshooting.