Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2Network AssuranceEasy
A network administrator needs to capture traffic on a Cisco Catalyst 9300 switch to analyze a performance issue affecting a server connected to an access port. The server's traffic must be mirrored to a monitoring station connected to a different port on the same switch, without impacting the switch's forwarding performance. Which feature should the administrator configure?
- ASwitched Port Analyzer (SPAN)
- BNetFlow
- CEncapsulated Remote SPAN (ERSPAN)
- DRemote SPAN (RSPAN)
Show answer & explanationAnswer & explanation
Correct answer: A. Switched Port Analyzer (SPAN)
SPAN is used to mirror traffic from one or more source ports or VLANs to a destination port on the same switch. This is the most straightforward and efficient method for local traffic analysis.
Why the other options are wrong
- B. NetFlow provides flow statistics and not a full packet capture, which is needed for detailed performance analysis.
- C. ERSPAN is used for mirroring traffic across Layer 3 boundaries or to a remote destination via an IP tunnel.
- D. RSPAN is used to mirror traffic between different switches, requiring a dedicated RSPAN VLAN.
Switched Port Analyzer (SPAN)
A Cisco feature that allows mirroring traffic from source ports or VLANs to a destination port on the same switch for analysis.
- Local traffic mirroring
- One-to-one or many-to-one port mapping
- Does not forward mirrored traffic itself, only copies it
Memory trick: SPAN is your local traffic spy, RSPAN crosses switches, ERSPAN goes far, NetFlow just counts cars.