CHFI Network and Cloud Forensics Practice Question
An investigator needs to capture network traffic from a live network segment without altering the traffic flow. Which technique should they use?
⚠ Common exam trap
EC-Council often tests the misconception that promiscuous mode alone is sufficient for capturing all traffic on a switched network, but candidates forget that switches isolate traffic per port unless a SPAN port is configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a SPAN port on the switch
A SPAN (Switched Port Analyzer) port, also known as a mirror port, copies all traffic from a specified source port or VLAN to a destination port where the forensic workstation is connected. This allows the investigator to capture traffic without injecting any frames or altering the forwarding behavior of the switch, thus preserving the integrity of the live network segment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable NetFlow on the router and capture flows
Why it's wrong here
NetFlow on a router exports aggregated flow records—source and destination IPs, ports, protocol, and byte/packet counts—rather than the raw frames and payloads needed for packet-level forensics. It also only observes traffic routed through that specific router, missing switch-local communications between hosts on the same VLAN, and its sampling-based architecture cannot guarantee the full capture required for legal evidence.
- ✓
Configure a SPAN port on the switch
Why this is correct
Configuring a SPAN (Switched Port Analyzer) port on the switch copies ingress and egress frames from specified source ports or VLANs to a designated monitor port, where a forensic workstation can record full packets without altering the original traffic path. This non-intrusive mirroring preserves switch performance and avoids introducing latency or dropping frames, making it the standard method for lawful network capture at Layer 2.
- ✗
Deploy an ARP spoofing tool to redirect traffic
Why it's wrong here
ARP spoofing actively forges ARP replies to poison the victim's and gateway's ARP caches, redirecting traffic through the investigator's machine as a man-in-the-middle. This changes the actual forwarding topology, can cause dropped or delayed frames, and risks triggering switch protections like Dynamic ARP Inspection or port security—plus the diverted traffic is modified in transit, which taints the evidence's integrity.
- ✗
Set the NIC to promiscuous mode on the forensic workstation
Why it's wrong here
Setting the NIC to promiscuous mode merely instructs the host adapter to accept all frames that arrive on its physical link, but a switch forwards only frames destined to the workstation's own MAC address, plus broadcasts and multicasts. Since each switch port is an isolated collision domain, traffic between other hosts on the same switch never reaches this interface, so promiscuous mode alone captures nothing beyond the host's own traffic; a TAP, SPAN port, or inline device is required to obtain a copy of neighbor traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.