Which three probes should be avoided due to excessive overhead?

The choice of DHCP SPAN as the probe to be avoided due to excessive overhead is based on the nature of how SPAN (Switched Port Analyzer) operates. SPAN is used to monitor and replicate traffic from one or more ports to a designated monitoring port on the switch. When DHCP traffic is forwarded via SPAN, the overhead can significantly increase, especially in environments with high DHCP traffic or a large number of DHCP clients. This is because SPAN captures all packets and sends them to the monitoring device, potentially leading to saturated network resources and performance issues.

In contrast, Device Sensor, NetFlow, and RADIUS probes are generally designed to be more efficient. Device Sensor captures specific attributes about devices connecting to the network without generating excessive traffic. NetFlow allows for the export of flows, which provides visibility into the network's traffic patterns with minimal impact. RADIUS probes are also designed for authenticating and authorizing access, operating efficiently without creating excessive overhead. Therefore, avoiding DHCP SPAN helps maintain network performance by minimizing the impact of excessive traffic capture.