N10-009 Question 203
Single answer3.2 Given a scenario, use network monitoring technologies.A network administrator is troubleshooting intermittent slowness reported by users in a branch office. The WAN link is not saturated according to interface bandwidth graphs, but users say file transfers to the data center sometimes pause for several seconds. The administrator needs to identify which conversations and applications are consuming bandwidth during the affected periods without capturing every packet. Which monitoring technology should the administrator use?
- A
NetFlow
- B
Syslog
- C
SNMP
- D
Packet broker
- E
Port mirroring
Show answer and explanation
Correct answer: A
Explanation
The best answer is NetFlow because the requirement is to identify which conversations and applications are consuming bandwidth during intermittent performance issues without performing full packet capture. Flow-monitoring technologies such as NetFlow and similar implementations (for example, IPFIX or sFlow in some environments) are widely used to identify top talkers, protocols, and traffic patterns while using much less storage and processing than packet capture. By contrast, SNMP is best for device and interface statistics, syslog is best for event logging, and port mirroring is typically used when a packet analyzer needs full traffic visibility. This aligns with common vendor and industry best practices: use SNMP for health and utilization baselines, syslog for operational events, and flow technologies for traffic analysis and capacity troubleshooting.
- A. Correct.
Correct. NetFlow is designed to summarize traffic flows by source/destination, ports, protocol, and volume, allowing an administrator to identify top talkers and application usage without storing full packet captures. This makes it well suited for investigating intermittent bandwidth consumption and conversation-level analysis on WAN links.
- B. Incorrect.
Incorrect. Syslog collects event and log messages from network devices and servers, such as interface state changes, authentication events, or routing issues. While useful for correlating faults and events, it does not provide conversation-level traffic accounting needed to determine which hosts or applications are using bandwidth during slow periods.
- C. Incorrect.
Incorrect. SNMP is commonly used for polling interface counters, errors, CPU, memory, and device health metrics. In this scenario, SNMP-style bandwidth graphs have already shown that the link is not saturated. Standard SNMP monitoring does not typically provide the detailed flow visibility needed to identify specific applications or host conversations causing pauses.
- D. Incorrect.
Incorrect. A packet broker aggregates, filters, and forwards traffic copies to monitoring tools, but it is not itself the primary monitoring technology for identifying top conversations in this scenario. It is an infrastructure component that supports tools such as packet analyzers or IDS platforms.
- E. Incorrect.
Incorrect. Port mirroring can copy packets to an analyzer for deep inspection, but the scenario specifically says the administrator wants to avoid capturing every packet. Port mirroring is useful when full packet analysis is required, but flow-based monitoring is a more efficient fit for identifying bandwidth-consuming conversations over time.