A network engineer wants to capture all traffic between two specific hosts connected to different access layer switches (Switch A and Switch B) in the same building. The captured traffic needs to be sent to a dedicated analysis port on a third switch (Switch C) in the data center for deep packet inspection. All switches are Cisco Catalyst 9300 series. Which SPAN variant is the most appropriate for this scenario?
- ARemote SPAN (RSPAN)
- BVLAN-based SPAN (VSPAN)
- CLocal SPAN (LSPAN)
- DEncapsulated Remote SPAN (ERSPAN)
Show answer & explanationAnswer & explanation
Correct answer: D. Encapsulated Remote SPAN (ERSPAN)
ERSPAN is the most appropriate because it allows for monitoring traffic from multiple source ports/VLANs on different switches and sending it to a destination port on yet another switch, potentially across a routed network, by encapsulating the mirrored traffic in a GRE tunnel. This allows the analysis port to be in a different location (data center) from the source switches.
Why the other options are wrong
- A. RSPAN can span across multiple switches within a single VLAN by using a dedicated RSPAN VLAN, but the destination port must be in the same RSPAN VLAN, limiting its flexibility across routed networks.
- B. VSPAN is a type of LSPAN/RSPAN that monitors an entire VLAN, but doesn't address multi-switch, multi-VLAN source, and remote routed destination requirements as flexibly as ERSPAN.
- C. LSPAN only mirrors traffic on ports/VLANs within a single switch.
Encapsulated Remote SPAN (ERSPAN)
ERSPAN is a Cisco feature that allows traffic from source ports or VLANs on one or more switches to be mirrored and sent to a destination port on a different switch over a routed network by encapsulating the mirrored traffic in a Generic Routing Encapsulation (GRE) tunnel.
- Supports sources and destinations across different switches and routed networks.
- Uses GRE encapsulation to transport mirrored traffic.
- Ideal for centralized monitoring of distributed network segments.
Memory trick: ERSPAN: Everywhere, Routed, Spanned, for Any Network.