Which term describes copying ingress and/or egress communications from one or more switch ports to another port to monitor communications passing over the switch?

Which term describes copying ingress and/or egress communications from one or more switch ports to another port to monitor communications passing over the switch?

• A. SPAN (switched port analyzer)/mirror port
• B. Sensor
• C. TAP
• D. Inline

Answer: (A)

Port mirroring, commonly called SPAN, is the feature on a switch that copies traffic from one or more source ports and sends a duplicate to a designated destination port for monitoring. This lets a network analyzer, IDS, or sensor observe both incoming and outgoing traffic without affecting the original frames traveling through the switch. It’s exactly what’s described when you copy ingress and/or egress communications to a single port so you can monitor what’s passing over the switch. A TAP, by contrast, is a separate hardware device placed on the physical link to copy traffic independently of the switch, not a switch feature. Inline describes placing a security device directly in the traffic path so it can inspect or block traffic as it flows, rather than merely duplicating it for analysis. A sensor refers to the monitoring device itself, not the act of duplicating traffic within the switch.

Port mirroring, commonly called SPAN, is the feature on a switch that copies traffic from one or more source ports and sends a duplicate to a designated destination port for monitoring. This lets a network analyzer, IDS, or sensor observe both incoming and outgoing traffic without affecting the original frames traveling through the switch. It’s exactly what’s described when you copy ingress and/or egress communications to a single port so you can monitor what’s passing over the switch.

A TAP, by contrast, is a separate hardware device placed on the physical link to copy traffic independently of the switch, not a switch feature. Inline describes placing a security device directly in the traffic path so it can inspect or block traffic as it flows, rather than merely duplicating it for analysis. A sensor refers to the monitoring device itself, not the act of duplicating traffic within the switch.