SPAN, RSPAN, and ERSPAN

A network engineer configures SPAN on a Cisco Catalyst switch to monitor traffic between two hosts. The engineer configures the source interface as GigabitEthernet0/1 and the destination interface as GigabitEthernet0/2. After the configuration, the engineer notices that the monitored traffic is not being forwarded to the destination port. What is the most likely cause?

An engineer configures RSPAN on a Cisco switch to monitor traffic from VLAN 10 across multiple switches. The engineer creates an RSPAN VLAN (VLAN 100) on the source switch and configures the source as VLAN 10. On the remote switch, the engineer configures the destination port as GigabitEthernet0/1 in VLAN 100. However, the destination port does not forward any monitored traffic. What is the most likely cause?

A network engineer is troubleshooting an ERSPAN configuration where traffic from a source router is being sent to a remote monitoring server. The engineer configures an ERSPAN source session on Router A to capture traffic on GigabitEthernet0/0 and send it to the IP address 10.1.1.100. The monitoring server does not receive any packets. The engineer verifies that IP connectivity exists between Router A and the server. What is the most likely cause?

An engineer configures a local SPAN session on a Cisco switch to monitor all traffic on VLAN 20. The engineer uses the command 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface GigabitEthernet0/3'. The engineer connects a laptop to GigabitEthernet0/3 and runs a packet capture, but sees only traffic from the switch itself, not from other devices in VLAN 20. What is the most likely cause?

A network engineer configures an RSPAN session on Switch A to monitor traffic from interface GigabitEthernet0/1 and sends it to Switch B. The engineer creates RSPAN VLAN 50 on both switches and configures the trunk between them to allow VLAN 50. On Switch B, the engineer configures the destination port as GigabitEthernet0/2 in VLAN 50. The engineer notices that the destination port is not forwarding any traffic. What should the engineer check first?

An engineer configures ERSPAN on a Cisco router to monitor traffic on interface GigabitEthernet0/0/0 and send it to a monitoring server at 192.168.1.100. The engineer configures the ERSPAN session with a tunnel source of 10.0.0.1 and a tunnel destination of 192.168.1.100. The monitoring server receives no packets. The engineer pings 192.168.1.100 from the router and succeeds. What is the most likely cause?

A network engineer configures a SPAN session on a Cisco switch to monitor traffic on interface GigabitEthernet0/1 and sends it to interface GigabitEthernet0/2. The engineer notices that the destination port is up but does not forward any traffic. The engineer checks the configuration and sees that the destination port is configured as a trunk port. What is the most likely cause?

An engineer configures an RSPAN session on a Cisco switch to monitor traffic from VLAN 30 and send it to a remote switch. The engineer creates RSPAN VLAN 200 on both switches and configures the trunk to allow VLAN 200. On the remote switch, the engineer configures the destination port as GigabitEthernet0/4 in VLAN 200. The engineer notices that the destination port is forwarding traffic, but the traffic is not from the source VLAN 30; instead, it is broadcast traffic from other VLANs. What is the most likely cause?

A network engineer configures an ERSPAN session on a Cisco router to monitor traffic on interface GigabitEthernet0/0/0 and send it to a monitoring server at 172.16.1.100. The engineer uses the command 'monitor session 1 type erspan-source' and configures the tunnel. The monitoring server receives packets, but the packets contain only the original source and destination IP addresses of the monitored traffic, not the encapsulated GRE headers. What is the most likely cause?

A network engineer runs the following command on switch SW1: SW1# show monitor session 1 Session 1 --------- Type : Local Session Source Ports : Both : Gi0/1, Gi0/2 Destination Ports : Gi0/3 Encapsulation : Native Ingress : Disabled Based on this output, which statement is correct?

A network engineer runs the following command on switch SW2: SW2# show monitor session 2 Session 2 --------- Type : Remote Source Session Source Ports : Both : Gi0/4 Source VLANs : RX Only : 100 Destination Ports : Gi0/5 Encapsulation : Native Ingress : Disabled Based on this output, which statement is correct?

A network engineer runs the following command on switch SW3: SW3# show monitor session 3 Session 3 --------- Type : Remote Destination Session Source Ports : RX Only : Gi0/6 Destination Ports : Gi0/7 Encapsulation : Native Ingress : Disabled Based on this output, which statement is correct?

A network engineer runs the following command on router R2: R2# show monitor session 4 Session 4 --------- Type : ERSPAN Source Session Status : Admin Enabled Source Ports : Both : Gi0/0 Destination IP : 192.168.1.10 Origin IP : 10.0.0.2 ERSPAN ID : 100 Based on this output, which statement is correct?

A network engineer runs the following command on router R3: R3# show monitor session 5 Session 5 --------- Type : ERSPAN Destination Session Status : Admin Enabled Source IP : 10.0.0.2 Destination Ports : Gi0/1 Encapsulation : Native Ingress : Disabled ERSPAN ID : 100 Based on this output, which statement is correct?

A network engineer runs the following command on switch SW4: SW4# show monitor session 6 Session 6 --------- Type : Local Session Source Ports : Both : Gi0/8, Gi0/9 Destination Ports : Gi0/10 Encapsulation : Native Ingress : Enabled Based on this output, which statement is correct?

A network engineer runs the following command on switch SW5: SW5# show monitor session 7 Session 7 --------- Type : Local Session Source Ports : Both : Gi0/11 Destination Ports : Gi0/12 Encapsulation : Replicate Ingress : Disabled Based on this output, which statement is correct?

A network engineer runs the following command on switch SW6: SW6# show monitor session 8 Session 8 --------- Type : Remote Source Session Source Ports : Both : Gi0/13 Source VLANs : TX Only : 200 Destination Ports : Gi0/14 Encapsulation : Dot1q Ingress : Disabled Based on this output, which statement is correct?

A network engineer runs the following command on router R4: R4# show monitor session 9 Session 9 --------- Type : ERSPAN Source Session Status : Admin Disabled Source Ports : Both : Gi0/2 Destination IP : 192.168.2.20 Origin IP : 10.0.0.3 ERSPAN ID : 200 Based on this output, which statement is correct?

Consider the following partial configuration on a Cisco IOS-XE switch: monitor session 1 source interface GigabitEthernet1/0/1 both monitor session 1 destination interface GigabitEthernet1/0/2 What is the effect of this configuration?

Given the configuration: monitor session 2 source vlan 10-12 both monitor session 2 destination interface GigabitEthernet1/0/3 Which statement is true?

Examine the RSPAN configuration: vlan 100 name RSPAN_VLAN remote-span ! monitor session 1 source interface GigabitEthernet1/0/1 both monitor session 1 destination remote vlan 100 What is the purpose of the 'remote-span' command under VLAN 100?

Consider the ERSPAN configuration on a router: monitor session 1 type erspan-source source interface GigabitEthernet0/0/1 both destination erspan-id 1 ip address 192.168.1.100 origin ip address 192.168.1.1 What is the primary purpose of the 'origin ip address' command?

A network engineer configured the following: monitor session 3 type erspan-source source interface GigabitEthernet0/0/2 rx destination erspan-id 2 ip address 10.0.0.2 origin ip address 10.0.0.1 What traffic will be mirrored?

What is missing from this RSPAN configuration on a switch? monitor session 1 source interface GigabitEthernet1/0/1 both monitor session 1 destination remote vlan 100 Assume VLAN 100 exists but is not configured as an RSPAN VLAN.

What is the default behavior of a local SPAN session if no direction (rx, tx, both) is specified?

In ERSPAN, what is the default encapsulation type used for transporting mirrored packets across an IP network?

Which of the following is a limitation of local SPAN on a Cisco switch?

Which TWO commands verify the operational status of a local SPAN session on a Cisco IOS-XE switch? (Choose TWO.)

Which THREE symptoms indicate a misconfigured RSPAN session on a Cisco switch? (Choose THREE.)

Which TWO configuration steps are required to set up an ERSPAN session on a Cisco IOS-XE device? (Choose TWO.)

Which TWO statements about RSPAN are true? (Choose TWO.)

Which THREE commands are used to troubleshoot a SPAN session on a Cisco Catalyst switch? (Choose THREE.)

An engineer configures ERSPAN on Router R1 to monitor traffic from VLAN 100 to a remote collector at 192.168.10.10 via a GRE tunnel. The source interface is GigabitEthernet0/0/0. After configuration, the collector receives no mirrored packets. R1's configuration: monitor session 1 type erspan-source source interface Gi0/0/0 both destination erspan-id 100 ip address 192.168.10.10 origin ip address 10.1.1.1 no shutdown. R1's routing table shows a default route via 10.1.1.2, and a static route to 192.168.10.0/24 via 10.1.1.2. The tunnel interface Tunnel0 is up/up with IP 10.1.1.1/30. What is the most likely root cause?

A network engineer configures RSPAN on a switch to monitor traffic from VLAN 10 to a remote switch via VLAN 100 as the RSPAN VLAN. The source switch has: monitor session 1 source vlan 10 rx monitor session 1 destination remote vlan 100. The remote switch has: monitor session 2 source remote vlan 100 monitor session 2 destination interface Gi0/1. The remote switch's Gi0/1 is connected to a network analyzer. The analyzer sees no traffic. The RSPAN VLAN 100 is configured on all intermediate switches with the 'remote-span' command. However, the intermediate switches run MST and VLAN 100 is mapped to a different MST instance than the native VLAN. What is the root cause?

Router R1 is configured as an ERSPAN source to monitor traffic on interface Serial0/0/0. The destination is a collector at 172.16.1.100. R1's configuration: monitor session 1 type erspan-source source interface Serial0/0/0 both destination erspan-id 1 ip address 172.16.1.100 origin ip address 10.0.0.1. The collector is reachable via a default route. The network also uses CoPP (Control Plane Policing) with a policy that polices all incoming traffic to the control plane. The collector receives no packets. What is the most likely issue?

A network engineer configures SPAN on a switch to monitor traffic from VLAN 20 to a local analyzer on interface Gi0/1. The configuration: monitor session 1 source vlan 20 rx monitor session 1 destination interface Gi0/1. The analyzer sees no traffic. The switch runs OSPF and has a route to 0.0.0.0/0 via a neighbor. The Gi0/1 interface is configured as a trunk port with native VLAN 1. The analyzer is connected to a hub that also connects to another device. The other device sends traffic that causes the switch to learn MAC addresses on Gi0/1. What is the root cause?

An engineer configures ERSPAN on Router R1 to monitor traffic from VLAN 30 to a collector at 192.168.1.100. The router has multiple VRFs: VRF A and VRF B. The source interface Gi0/0/0 is in VRF A. The collector is in VRF B. R1's configuration: monitor session 1 type erspan-source source interface Gi0/0/0 both destination erspan-id 2 ip address 192.168.1.100 origin ip address 10.0.0.1. The collector is reachable via a route in VRF B. The router has a route-leaking configuration between VRFs. The collector receives no traffic. What is the root cause?

A switch is configured with RSPAN to monitor traffic from VLAN 50 to a remote switch via VLAN 200. The source switch has: monitor session 1 source vlan 50 rx monitor session 1 destination remote vlan 200. The remote switch has: monitor session 2 source remote vlan 200 monitor session 2 destination interface Gi0/2. The intermediate switches have VLAN 200 configured with 'remote-span'. The network uses VTP transparent mode. The analyzer connected to Gi0/2 sees intermittent traffic. The RSPAN VLAN 200 is also used as a native VLAN on some trunk ports. What is the likely cause of intermittent traffic?

Router R1 is configured as an ERSPAN source to monitor traffic on interface GigabitEthernet0/0/0. The destination is a collector at 10.10.10.10. R1's configuration: monitor session 1 type erspan-source source interface Gi0/0/0 both destination erspan-id 3 ip address 10.10.10.10 origin ip address 192.168.1.1. The router has an ACL applied to the interface Gi0/0/0 that denies all IP traffic from source 192.168.1.1. The collector receives no packets. What is the root cause?

A switch is configured with SPAN to monitor traffic on interface Gi0/0/0 to a local analyzer on interface Gi0/1. The configuration: monitor session 1 source interface Gi0/0/0 both monitor session 1 destination interface Gi0/1. The analyzer sees only half of the traffic (only incoming or outgoing). The switch also has an EtherChannel configured on Gi0/0/0 as part of a port-channel. The port-channel is up/up. What is the root cause?

Router R1 is configured as an ERSPAN source to monitor traffic on interface Tunnel0 (a DMVPN tunnel). The destination is a collector at 172.16.0.100. R1's configuration: monitor session 1 type erspan-source source interface Tunnel0 both destination erspan-id 4 ip address 172.16.0.100 origin ip address 10.0.0.1. The collector receives no packets. The Tunnel0 interface is up/up and has an IP of 10.0.0.1/30. The tunnel destination is 192.168.1.1. The router has a route to 172.16.0.100 via 10.0.0.2. What is the root cause?

A network engineer runs the following command to troubleshoot a SPAN issue: R1# show monitor session 1 detail Session 1 --------- Type : Local Session Source Ports : Both : Gi0/0 Destination Ports : Gi0/1 Encapsulation : Native Ingress : Disabled What does this output indicate?

A network engineer runs the following command to troubleshoot an RSPAN issue: R1# show monitor session 2 detail Session 2 --------- Type : Remote Source Session Source Ports : Both : Gi0/0 Destination RSPAN VLAN : 100 What does this output indicate?

A network engineer runs the following command to troubleshoot an ERSPAN issue: R1# show monitor session 3 detail Session 3 --------- Type : ERSPAN Source Session Source Ports : Both : Gi0/0 Destination IP : 10.1.1.1 ERSPAN ID : 100 What does this output indicate?

A network engineer runs the following command to troubleshoot an RSPAN issue: R1# show monitor session 4 detail Session 4 --------- Type : Remote Destination Session Source RSPAN VLAN : 100 Destination Ports : Gi0/2 Encapsulation : Native Ingress : Disabled What does this output indicate?

A network engineer runs the following command to troubleshoot an ERSPAN issue: R1# show monitor session 5 detail Session 5 --------- Type : ERSPAN Destination Session Source IP : 10.1.1.2 ERSPAN ID : 100 Destination Ports : Gi0/3 Encapsulation : Native Ingress : Disabled What does this output indicate?

A network engineer runs the following command to troubleshoot a SPAN issue: R1# show monitor session all Session 1 --------- Type : Local Session Source Ports : Both : Gi0/0 Destination Ports : Gi0/1 Encapsulation : Native Ingress : Disabled Session 2 --------- Type : Remote Source Session Source Ports : Both : Gi0/2 Destination RSPAN VLAN : 100 What does this output indicate?

A network engineer runs the following command to troubleshoot an ERSPAN issue: R1# show monitor session 6 detail Session 6 --------- Type : ERSPAN Source Session Source VLANs : Both : 10-20 Destination IP : 10.1.1.3 ERSPAN ID : 200 What does this output indicate?

A network engineer runs the following command to troubleshoot a SPAN issue: R1# debug monitor session 1 *Mar 1 00:00:01.123: MONITOR: Session 1: Packet captured on Gi0/0, forwarded to Gi0/1 *Mar 1 00:00:02.456: MONITOR: Session 1: Packet captured on Gi0/0, forwarded to Gi0/1 What does this output indicate?

A network engineer runs the following command to troubleshoot an ERSPAN issue: R1# show ip interface brief | include Gi0/0 GigabitEthernet0/0 10.1.1.1 YES NVRAM up up R1# show monitor session 7 detail Session 7 --------- Type : ERSPAN Source Session Source Ports : Both : Gi0/1 Destination IP : 10.1.1.2 ERSPAN ID : 300 What does this output indicate?

What is the default ERSPAN encapsulation type on Cisco IOS-XE devices?

Which statement about the SPAN destination port behavior is correct?

What is the maximum number of source ports that can be monitored in a single SPAN session on a typical Cisco Catalyst switch?

Which statement about RSPAN VLAN is correct?

What is the default ERSPAN ID range on Cisco IOS-XE devices?

Which of the following is true about the SPAN source interface configuration?

What is the maximum number of ERSPAN sessions that can be configured on a Cisco IOS-XE router?

Which statement about RSPAN source session is correct?

What is the default MTU size for ERSPAN encapsulated packets on Cisco IOS-XE?

Drag and drop the steps to configure an ERSPAN session for remote traffic capture into the correct order, from first to last.

Drag and drop the steps to troubleshoot SPAN, RSPAN, and ERSPAN adjacency or connectivity failures into the correct order, from first to last.

Drag and drop the steps to verify and validate SPAN, RSPAN, and ERSPAN operational state into the correct order, from first to last.

Which TWO statements about ERSPAN source session configuration are correct? (Choose TWO.)

Which TWO statements about RSPAN configuration and operation are correct? (Choose TWO.)

Which TWO statements about the limitations of local SPAN are correct? (Choose TWO.)

Which TWO statements about verifying SPAN, RSPAN, and ERSPAN sessions are correct? (Choose TWO.)

Which TWO statements about the configuration of an ERSPAN destination session are correct? (Choose TWO.)

An engineer configures SPAN on a Cisco switch to monitor traffic from a source VLAN. Unexpectedly, BPDU guard shuts down the monitoring port when a switch is connected to it. Which is the most likely explanation?

An engineer configures RSPAN VLAN 100 on two switches to monitor traffic across the network. The remote switch shows the RSPAN source as active, but the destination switch receives no mirrored traffic. What is the most likely cause?

An engineer configures ERSPAN on a Cisco router to send mirrored traffic to a remote collector via IP. The collector receives the ERSPAN packets, but the payload appears truncated or malformed. What is the most likely cause?

An engineer configures SPAN on a Cisco switch to monitor both ingress and egress traffic on a trunk port. The monitor session shows only egress traffic, not ingress. What is the most likely explanation?

An engineer configures ERSPAN on a Cisco router to monitor traffic from a VRF. The mirrored traffic reaches the collector, but the source IP address in the ERSPAN header is the router's loopback, not the expected interface IP. What is the most likely cause?

An engineer configures RSPAN on a switch stack to monitor traffic from a VLAN. The RSPAN destination port is on a different stack member. The mirrored traffic works intermittently, with gaps during stack master re-election. What is the most likely explanation?

An engineer configures SPAN on a Cisco switch to monitor traffic from a port that is also a SPAN destination for another session. The switch rejects the configuration. What is the most likely reason?

An engineer configures ERSPAN on a Cisco router to monitor traffic from a tunnel interface. The mirrored traffic shows the tunnel's inner IP headers, but the outer encapsulation is missing. What is the most likely cause?

An engineer configures SPAN on a Cisco switch to monitor traffic from a VLAN, but the VLAN includes a voice VLAN. The mirrored traffic shows only data traffic, not voice. What is the most likely explanation?