Learn how to establish a passive network collection environment. This simulation focuses on network traffic acquisition techniques and identifying the proper terminology for switch-based traffic duplication.

CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

During a network-forensics investigation at a financial firm in Chicago, Illinois, an analyst is tasked with monitoring a compromised database server (IP: 10.10.50.22) for ongoing Command and Control (C2) beaconing.

To preserve the integrity of the network and avoid alerting the attacker via service disruption, the analyst connects a forensic workstation to the Cisco Catalyst core switch. The analyst configures the switch to duplicate all traffic from the database server's switchport to the forensic workstation's switchport for packet capture.

Evidence Collected

Exhibit 1: Core Switch Configuration Log (Cisco IOS)

Switch(config)# monitor session 1 source interface GigabitEthernet1/0/24 both Switch(config)# monitor session 1 destination interface GigabitEthernet1/0/48 encapsulation dot1q Switch# show monitor session 1 Session 1 --------- Type : Local Session Source Ports : Both : Gi1/0/24 Destination Ports : Gi1/0/48

Exhibit 2: Forensic Workstation Interface Status

[root@forensics-wks ~]# ifconfig eth1 eth1: flags=4355<UP,BROADCAST,PROMISC,MULTICAST> mtu 1500 inet6 fe80::a00:27ff:fe8c:5d12 prefixlen 64 scopeid 0x20<link> ether 08:00:27:8c:5d:12 txqueuelen 1000 (Ethernet) [root@forensics-wks ~]# tcpdump -i eth1 -w capture_chicago.pcap tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes

Question

In a network-forensics investigation in Chicago, an analyst is capturing network traffic using a span port on a switch. What is this type of traffic capture commonly called?

Look at Exhibit 1. The configuration monitor session ... destination interface explicitly creates a duplicate stream of traffic from one port to another. The acronym SPAN stands for Switched Port Analyzer, which relies on duplicating or "mirroring" the switch port.

Expert Analysis

1. What the Evidence Shows

The Cisco switch configuration explicitly demonstrates the creation of a local monitor session. Traffic passing through interface Gi1/0/24 (the compromised database server) is being actively duplicated and sent to Gi1/0/48. Exhibit 2 shows the forensic workstation interface (eth1) is set to promiscuous mode (PROMISC) to successfully ingest and capture these duplicated packets using tcpdump.

2. Forensic Stage

This falls under the Collection phase of the digital forensics process, specifically Network Data Acquisition. The goal is to preserve volatile network data without altering the state of the original communication.

3. Why the Correct Answer is Correct (A)

Port mirroring, also widely known as SPAN (Switched Port Analyzer), is the technique of configuring a network switch to forward a copy of each incoming and/or outgoing packet from one or more ports to another designated port. It is the primary switch-based mechanism used for deploying intrusion detection systems (IDS) and conducting passive network forensics.

4. Why the Others are Wrong

Network tapping (B): While it achieves a similar goal, a network tap involves installing a physical, inline hardware device between two nodes to copy traffic. It is not a software-based configuration on a switch.
Packet sniffing (C): This describes the secondary process of intercepting and analyzing the packets using tools like Wireshark or tcpdump. The actual configuration of the switch to duplicate the traffic is port mirroring.
Traffic filtering (D): Filtering involves using Access Control Lists (ACLs) or firewalls to block or permit traffic based on specific rules, rather than duplicating it for forensic analysis.

5. Real-World Forensic Action

When implementing port mirroring, a forensic analyst must be aware of "oversubscription." If a full-duplex 1Gbps link (total 2Gbps potential traffic) is mirrored to a single 1Gbps destination port, the switch may drop packets during high traffic volumes. After capture, the resulting PCAP file must be cryptographically hashed (e.g., SHA-256) immediately to maintain the chain of custody.

MINI LESSON: Active vs. Passive Collection

Establishing a solid chain of custody in network forensics requires understanding the tools used for collection. Port mirroring is a passive collection method—it does not modify the original traffic stream. However, because it relies on the switch's CPU and backplane, it can drop frames under heavy load. In contrast, Hardware Taps are highly preferred in strict forensic investigations because they guarantee 100% packet duplication without reliance on switch software, providing absolute evidence integrity.

Ready for the next challenge?

Enhance your CHFI exam readiness with full-length realistic practice simulations.

Explore more CHFI simulations