One of your servers is suffering from intermittent poor performance. As the CPU, RAM, and disk utilization are normal, you suspect it is the target of a network-based hacking attack. You would like to place a sniffer with a protocol analyzer next to the server's network interface to monitor traffic. The server is connected to an Ethernet switch, but the switch does not have port mirroring capability. You also do not want to add to the server's load by running the sniffer on the server itself. What logical network topology do you need to place a sniffer next to the server, and how would you implement it?

You need to configure the server and the sniffer in a logical star. Plug the sniffer into the switch port that is next to the server's switch port.

You need to configure the server and the sniffer in a logical ring. Unplug the server from the switch port, plug a hub into the switch, and then plug the server and the sniffer into the token ring hub.

You need to configure the server and the sniffer in a logical bus. Unplug the server from its switch port, plug a hub in its place, and then plug both the switch and the sniffer into the hub.

Explanation

Using a logical bus will work. Because the hub is a logical bus, it will repeat all traffic out of all ports. The sniffer will receive all traffic sent to and from the server. The only disadvantage is that a hub is a half-duplex device. The server will have to take turns transmitting and receiving, so this may have a negative impact on performance. Using a logical star will not work because the switch will not pass any of the server's traffic to the sniffer. Using a logical ring will not work because Ethernet does not use a ring topology.