Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2InfrastructureMedium
A network engineer needs to monitor traffic between a web server and its clients without disrupting the production network. The monitoring device is located on a different switch in a different VLAN from the web server. Which feature should the engineer configure to achieve this monitoring capability?
- ARSPAN
- BLocal SPAN
- CNetFlow
- DERSPAN
Show answer & explanationAnswer & explanation
Correct answer: A. RSPAN
RSPAN (Remote SPAN) allows traffic from source ports on one switch to be mirrored to a destination port on another switch. This is achieved by encapsulating the mirrored traffic in a dedicated RSPAN VLAN, which can traverse multiple switches.
Why the other options are wrong
- B. Local SPAN mirrors traffic within the same switch, which doesn't meet the requirement of monitoring from a different switch.
- C. NetFlow collects flow statistics (source/destination IP, ports, etc.) but does not provide a full packet capture for detailed traffic analysis.
- D. ERSPAN extends RSPAN to encapsulate traffic in a GRE tunnel, allowing monitoring across routed networks, which is not strictly necessary if only bridging between switches is involved.
RSPAN (Remote SPAN)
A feature that allows network traffic to be monitored across multiple switches by mirroring traffic to a destination port on a different switch.
- Uses a dedicated RSPAN VLAN to carry mirrored traffic between switches.
- Requires configuration on both source and destination switches.
- Provides full packet capture for analysis but limited to Layer 2 domains.
Memory trick: SPAN is the mirror, RSPAN is the mirror across the room, ERSPAN is the mirror across the globe.