Exam N10-008 topic 1 question 631 discussion

C. Flow Data Mirroring a 40GB port on a server with a 10GB connection will cause excess packets received by the server to be dropped. Using NetFlow seems to make more sense. NetFlow is low overhead, port mirroring is resource intensive in high traffic environments. "SPAN which simply dumps everything it sees on specific ports to the monitoring port, NetFlow will provide more structured information. Specifically, NetFlow tracks flows." https://forum.networklessons.com/t/difference-between-span-and-netflow/9917/2

C. Flow data To determine the source of network saturation, the best method is to use flow data. Flow data provides information about the traffic patterns, including the source and destination addresses, protocols, and volume of traffic. It allows the network administrator to analyze and understand the flow of data across the network.

C. Flow Data Read the question carefully. It says what is the best method to use on the SERVER to determine the source of the saturation. Port mirroring is performed on switchports.

I'd like to know how you're going to mirror a port on a saturated 40GB circuit to a 10GB circuit. Or am I missing something?

I agree with both Sides of this argument but I do believe port mirroring is the best option as flow data is not specifically saying Netflow. While Port mirroring is an available option from the get go.

Port Mirroring

got it.

A Port Mirroring because that's what certmaster and everything I've studied says, while ChatGPT does indeed vote for Flow Data I don't think that's the best.

flow data is not even a real network+ term (not even networking for that matter)

Port mirroring is a technique that copies all or part of the traffic from one network port to another. This allows the administrator to analyze the traffic without having to overload the server's own connection. Log aggregation, flow data, and packet capture would all be too resource-intensive for the server's 10GB connection. Port mirroring is the most efficient way to collect and analyze the traffic.

A. Port mirroring Port mirroring (or port spanning) involves configuring a network switch to send a copy of network packets from one port (or a set of ports) to another designated port, where the server with the 10Gb connection is connected. By setting up port mirroring on the switch, the administrator can capture and analyze the network traffic passing through the 40Gb connection without affecting the actual traffic flow. This allows for effective monitoring and analysis of the network to identify the source of saturation.

C. Flow data. Flow data, collected through flow monitoring protocols such as NetFlow, sFlow, or IPFIX, provides aggregated information about network traffic, including details on source and destination IP addresses, ports, protocols, and more. This method doesn't capture the actual packet contents but summarizes network traffic flow. By leveraging flow data, the network administrator can gather information about the traffic patterns and bandwidth usage across the network. This method is less resource-intensive than performing packet captures and can provide valuable insights into the sources and destinations of the traffic causing the saturation on the 40Gb connection.