Question

List three limitations of using switches for collecting Network Forensic Evidence

Answer 1

Three limitations of using switches for collecting Network Forensic Evidence are:

(i) Switches are expensive.

(ii) They are vulnerable to security attacks.

(iii) Designing and configuration of switch is complex.

Hope this helps.

Answer 2

Here are three limitations of using switches for collecting Network Forensic Evidence:

1. Limited Visibility: Switches operate at the data link layer (Layer 2) and only forward traffic to the intended destination port, unlike hubs which broadcast traffic to all ports. This makes it harder to capture all network traffic for forensic analysis.

2. 
   

3. No Packet Storage: Switches do not store packets, so they cannot provide historical traffic data. Investigators must rely on external tools like port mirroring (SPAN) or network taps to capture real-time traffic.

4. 
   

5. Dependence on Configuration: Features like port mirroring or VLAN settings must be properly configured on the switch to collect evidence. Misconfiguration or lack of administrative access can hinder forensic investigations.