Question

A security engineer needs to establish network traffic baselines and detect volumetric anomalies (such as DDoS floods and unusual east-west traffic patterns) across dozens of Layer 3 switches and routers in a large campus. Storage capacity is limited, and the solution must scale without deploying dedicated capture appliances on every segment. Which technology best meets these requirements?

Accepted Answer

Enable NetFlow export on the Layer 3 devices to a flow collector for traffic accounting and anomaly detection

Answer

Deploy full packet capture (FPC) SPAN sessions on each distribution switch and store the raw packets centrally

Answer

Configure SNMPv3 polling of interface counters at 5-minute intervals on all devices

Answer

Enable syslog severity level 6 (informational) logging of all interface events to a central SIEM