350-401 SPAN and RSPAN — 15 Questions

Question 1

A network engineer is troubleshooting a performance issue between two hosts connected to a Cisco Catalyst 3850 switch. The engineer wants to capture all traffic sent and received by Host A (Gi1/0/1) and send it to a monitoring station connected to Gi1/0/24. The engineer configures 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'. However, the monitoring station receives only traffic sent by Host A, not traffic received. What is the most likely cause?

Accepted Answer

The destination port is in the same VLAN as the source interface, causing the switch to drop the copied frames due to loop prevention.. The 'both' keyword should capture both directions, but on some platforms, the destination port must be explicitly configured to allow ingress traffic for received traffic to be copied. The correct answer is that the destination port is not configured with 'monitor session 1 destination interface Gi1/0/24 ingress untagged' or similar, but the question focuses on a common misconfiguration: the destination port is in the same VLAN as the source, causing loops or filtering. Actually, the most common cause is that the source interface is configured as 'both' but the switch does not support egress SPAN on that interface without additional configuration. However, the best answer here is that the source interface is an access port and the destination port is in a different VLAN, and the SPAN session does not copy traffic from the source VLAN. But the scenario says both hosts are in the same VLAN. The correct answer is that the destination port is not configured to allow the SPAN traffic to be sent out; actually, the issue is that the destination port is in the same VLAN as the source, and the switch may drop the copied frames due to loop prevention. The most accurate answer: The engineer must ensure the destination port is not in the same VLAN as the source, or use a remote SPAN (RSPAN) VLAN. But the question asks for the cause. The cause is that the destination port is in the same VLAN as the source, and the switch's loop detection drops the copied frames. So the correct answer is that the destination port is in the same VLAN as the source interface, causing the switch to drop the replicated traffic.

Answer

The source interface is configured as an access port, and the SPAN session cannot capture both directions on an access port.

Answer

The 'monitor session 1 destination interface Gi1/0/24' command does not support egress SPAN; only ingress SPAN is allowed.

Answer

The engineer must also configure 'monitor session 1 filter ip' to capture both directions.

Question 2

A network engineer needs to monitor traffic between two VLANs on a Cisco Catalyst 9300 switch. The engineer wants to capture all packets that traverse the switch between VLAN 10 and VLAN 20. The monitoring station is connected to port Gi1/0/24. Which configuration should the engineer use to capture this inter-VLAN traffic?

Accepted Answer

Configure 'monitor session 1 source vlan 10 - 20 both' and 'monitor session 1 destination interface Gi1/0/24'.. Inter-VLAN traffic is routed by the switch's Layer 3 engine. To capture it, the engineer must use a SPAN session that sources from the VLANs themselves (VLAN-based SPAN) or from the SVI. The correct answer is to configure a SPAN session with source VLANs 10 and 20, and destination interface Gi1/0/24. This captures all traffic entering or leaving those VLANs, including routed traffic. Option A is incorrect because interface SPAN would only capture traffic on that specific port, not all inter-VLAN traffic. Option C is incorrect because RSPAN is for remote monitoring, not needed here. Option D is incorrect because ERSPAN is for encapsulated remote SPAN over IP, not needed.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure an RSPAN VLAN and use 'monitor session 1 source vlan 10 - 20' and 'monitor session 1 destination remote vlan 100'.

Answer

Configure an ERSPAN session with source IP and destination IP.

Question 3

An engineer is configuring RSPAN to monitor traffic from multiple switches in a data center. The monitoring station is connected to a central switch. The engineer has configured an RSPAN VLAN (VLAN 999) on all switches and set up the source sessions on the remote switches. However, the monitoring station receives no traffic. On the central switch, the engineer verifies that the RSPAN VLAN is active and that the destination session is configured. What is a likely missing configuration?

Accepted Answer

The trunk ports between the switches do not have the RSPAN VLAN (999) in their allowed VLAN list.. For RSPAN to work, the RSPAN VLAN must be allowed on all trunk links between the source switches and the destination switch. If the trunk ports do not have the RSPAN VLAN in their allowed list, the traffic will be dropped. Also, the RSPAN VLAN must not be pruned by VTP. The correct answer is that the trunk ports between the switches are not configured to allow the RSPAN VLAN. Option B is incorrect because the destination session is already configured. Option C is incorrect because the source session is already configured. Option D is incorrect because the RSPAN VLAN is active.

Answer

The destination session on the central switch is configured with 'monitor session 2 destination remote vlan 999' instead of 'monitor session 2 destination interface Gi1/0/1'.

Answer

The source sessions on the remote switches are configured with 'monitor session 1 source vlan 100' but the destination is not set to 'remote vlan 999'.

Answer

The RSPAN VLAN is not created as a remote SPAN VLAN; it must be configured with 'remote-span' command.

Question 4

A network engineer is using a Cisco Catalyst 3850 switch to monitor traffic from a server connected to port Gi1/0/1. The monitoring station is on port Gi1/0/24. The engineer configures 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'. The monitoring station receives traffic, but the engineer notices that the switch CPU utilization is high. What is the most likely cause of the high CPU?

Accepted Answer

The destination port is still a member of a VLAN, and the switch is processing the copied frames as normal traffic, leading to high CPU.. SPAN can cause high CPU if the destination port is not configured with 'ingress' or if the switch is overloaded. However, a common cause is that the destination port is configured to also forward traffic normally (i.e., it is not a dedicated SPAN destination). But the question says the monitoring station receives traffic, so the destination port is working. High CPU can occur if the SPAN session is configured to capture from a large number of sources or if the switch is processing many packets. The most likely cause here is that the destination port is not configured with 'switchport nonegotiate' or is in a VLAN that causes the switch to process the copied frames as normal traffic, leading to high CPU. But the best answer: The destination port should be configured as a SPAN destination only, and if it is also a member of a VLAN, the switch may try to switch the copied frames, causing high CPU. The correct answer is that the destination port is not configured as a SPAN destination-only port; it is still a member of a VLAN, causing the switch to process the copied frames as normal traffic.

Answer

The SPAN session is capturing both directions, which doubles the number of packets and increases CPU usage.

Answer

The destination port is not configured with 'switchport nonegotiate' and is still participating in DTP, causing CPU overhead.

Answer

The source interface is a trunk port, and SPAN is capturing all VLANs, causing high CPU.

Question 5

A network engineer needs to monitor traffic from a specific VLAN (VLAN 100) on a Cisco Catalyst 9300 switch and send the mirrored traffic to a monitoring station on a different switch across a routed network. The engineer decides to use ERSPAN. Which configuration is required on the source switch?

Accepted Answer

Configure 'monitor session 1 type erspan-source' and then 'source vlan 100' and 'destination ip 192.168.1.100'.. ERSPAN encapsulates mirrored traffic in GRE and sends it over IP. On the source switch, the engineer must configure an ERSPAN source session that specifies the source VLAN and the destination IP address of the monitoring station or the destination switch. The correct answer is to configure 'monitor session 1 type erspan-source' and then specify the source VLAN and the destination IP. Option B is incorrect because that is for local SPAN. Option C is incorrect because that is for RSPAN. Option D is incorrect because that is for local SPAN with a VLAN source.

Answer

Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination remote vlan 999'.

Answer

Configure 'monitor session 1 source vlan 100' and 'monitor session 1 destination interface Gi1/0/24' and then 'monitor session 1 encapsulation replicate'.

Question 6

An engineer is configuring SPAN on a Cisco Catalyst 3850 switch to monitor traffic from a trunk port (Gi1/0/1) that carries VLANs 10, 20, and 30. The monitoring station is on port Gi1/0/24. The engineer wants to capture only VLAN 20 traffic from the trunk. Which configuration should the engineer use?

Accepted Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 20'.. To capture traffic from a specific VLAN on a trunk port, the engineer must use the 'filter vlan' option in the SPAN session. The correct answer is to configure 'monitor session 1 source interface Gi1/0/1 both' and then 'monitor session 1 filter vlan 20'. Option B is incorrect because it captures all VLANs. Option C is incorrect because VLAN-based SPAN would capture all traffic on VLAN 20 from all ports, not just the trunk. Option D is incorrect because it captures only VLAN 20 but from all ports.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source vlan 20' and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' and 'monitor session 1 filter vlan 10,30'.

Question 7

A network engineer is troubleshooting a security issue and needs to capture all traffic between two servers connected to different switches. The switches are connected via a trunk link. The monitoring station is connected to a third switch. The engineer decides to use RSPAN. Which of the following is a mandatory requirement for RSPAN to function correctly?

Accepted Answer

The RSPAN VLAN must be configured with the 'remote-span' command on all switches.. RSPAN requires a dedicated VLAN (RSPAN VLAN) that is used to transport the mirrored traffic from source switches to the destination switch. This VLAN must be configured with the 'remote-span' command on all switches that participate. The correct answer is that the RSPAN VLAN must be configured with the 'remote-span' command. Option A is incorrect because the RSPAN VLAN does not need to be the native VLAN. Option B is incorrect because the RSPAN VLAN does not need to be pruned; in fact, it must be allowed on all trunks. Option D is incorrect because the RSPAN VLAN must be consistent across all switches, but it is not required to be the management VLAN.

Answer

The RSPAN VLAN must be configured as the native VLAN on all trunk ports.

Answer

The RSPAN VLAN must be pruned from all trunk ports to prevent loops.

Answer

The RSPAN VLAN must be the same as the management VLAN for the switches.

Question 8

An engineer is configuring SPAN on a Cisco Catalyst 9300 switch to monitor traffic from a port that is part of an EtherChannel (Port-channel 1). The monitoring station is on port Gi1/0/24. Which configuration should the engineer use to capture traffic from the EtherChannel?

Accepted Answer

Configure 'monitor session 1 source interface Port-channel 1 both' and 'monitor session 1 destination interface Gi1/0/24'.. SPAN can source from an EtherChannel interface. The correct answer is to use the port-channel interface as the source. Option B is incorrect because individual member ports cannot be used as SPAN sources if they are part of an EtherChannel; the SPAN session must reference the port-channel. Option C is incorrect because VLAN-based SPAN would capture all traffic on that VLAN, not just the EtherChannel. Option D is incorrect because RSPAN is not needed.

Answer

Configure 'monitor session 1 source interface Gi1/0/1 both' (where Gi1/0/1 is a member of the EtherChannel) and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure 'monitor session 1 source vlan 100' (the VLAN of the EtherChannel) and 'monitor session 1 destination interface Gi1/0/24'.

Answer

Configure an RSPAN VLAN and use 'monitor session 1 source interface Port-channel 1' and 'monitor session 1 destination remote vlan 999'.

Question 9

A network engineer is monitoring traffic from a server connected to a Cisco Catalyst 3850 switch. The engineer configures a SPAN session with source interface Gi1/0/1 and destination interface Gi1/0/24. The monitoring station receives traffic, but the engineer notices that the destination port is not forwarding any normal traffic. What is the most likely reason?

Accepted Answer

The destination port is automatically configured as a SPAN destination port, which disables normal switching on that port.. When a port is configured as a SPAN destination, it stops forwarding normal traffic by default. The port becomes a SPAN-only port. The correct answer is that the destination port is automatically put into a special state where it only sends SPAN traffic and does not forward normal data. Option B is incorrect because the destination port does not need to be in trunk mode. Option C is incorrect because the destination port does not need to be in access mode. Option D is incorrect because the destination port is not disabled; it is active for SPAN.

Answer

The destination port must be configured as a trunk port to forward SPAN traffic.

Answer

The destination port must be configured as an access port to forward SPAN traffic.

Answer

The destination port is in an err-disabled state due to a loop.

Question 10

A network engineer runs the following command on Switch SW1:

SW1# show monitor session 1
Session 1
---------
Type                   : Local Session
Source Ports           :
    Both               : Gi1/0/1
    Both               : Gi1/0/2
Destination Ports     : Gi1/0/10
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

Traffic from Gi1/0/1 and Gi1/0/2 is copied to Gi1/0/10 for monitoring.. The output shows a local SPAN session with source ports Gi1/0/1 and Gi1/0/2 (both directions) and destination port Gi1/0/10. The destination port is set to Native encapsulation, meaning it sends traffic in the original VLAN format. Ingress is disabled, so no incoming traffic on the destination port is forwarded. This is a standard local SPAN configuration.

Answer

This is an RSPAN session that sends traffic to a remote VLAN.

Answer

Ingress traffic on Gi1/0/10 is forwarded to the source ports.

Answer

The destination port is configured to capture only egress traffic.

Question 11

A network engineer runs the following command on Switch SW2:

SW2# show monitor session 2
Session 2
---------
Type                   : Remote Source Session
Source Ports           :
    TX Only            : Gi1/0/5
    RX Only            : Gi1/0/6
Destination Ports     : Gi1/0/20
    Encapsulation      : Replicate

Based on this output, what can be concluded?

Accepted Answer

This is an RSPAN source session, sending mirrored traffic to a remote VLAN.. The session type is Remote Source Session, indicating this is an RSPAN source switch. Source port Gi1/0/5 captures only transmitted traffic, and Gi1/0/6 captures only received traffic. The destination port uses Replicate encapsulation, which is typical for RSPAN to send traffic to a remote VLAN. This is part of an RSPAN configuration.

Answer

This is a local SPAN session with bidirectional capture.

Answer

The destination port Gi1/0/20 is used to receive mirrored traffic from another switch.

Answer

Both source ports capture all traffic in both directions.

Question 12

A network engineer runs the following command on Switch SW3:

SW3# show monitor session 3
Session 3
---------
Type                   : Remote Destination Session
Source RSPAN VLAN      : 100
Destination Ports      : Gi1/0/15
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

This switch receives mirrored traffic from the RSPAN VLAN and sends it to Gi1/0/15.. The session type is Remote Destination Session, which is the destination switch in an RSPAN setup. The source is an RSPAN VLAN (100), and the destination port Gi1/0/15 is used to monitor traffic from that VLAN. The destination port has Native encapsulation and ingress disabled, meaning it only sends out the mirrored traffic from the RSPAN VLAN.

Answer

This is a local SPAN session with source VLAN 100.

Answer

The RSPAN VLAN 100 is used to send traffic to a remote switch.

Answer

Ingress traffic on Gi1/0/15 is forwarded to the RSPAN VLAN.

Question 13

A network engineer runs the following command on Switch SW4:

SW4# show monitor session 4
Session 4
---------
Type                   : Local Session
Source VLANs           :
    RX Only            : 10,20
Destination Ports     : Gi1/0/25
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

Only incoming traffic on VLANs 10 and 20 is mirrored to Gi1/0/25.. The session is local SPAN with source VLANs 10 and 20, capturing only received traffic (RX Only). The destination port Gi1/0/25 sends out the mirrored traffic with Native encapsulation and ingress disabled. This monitors incoming traffic on those VLANs.

Answer

Both incoming and outgoing traffic on VLANs 10 and 20 are mirrored.

Answer

This is an RSPAN session using VLANs 10 and 20 as remote VLANs.

Answer

The destination port Gi1/0/25 is configured to receive mirrored traffic.

Question 14

A network engineer runs the following command on Switch SW5:

SW5# show monitor session 5
Session 5
---------
Type                   : Remote Source Session
Source Ports           :
    Both               : Gi1/0/1-3
Destination Ports     : Gi1/0/24
    Encapsulation      : Replicate

Based on this output, what can be concluded?

Accepted Answer

Traffic from ports Gi1/0/1-3 is mirrored and sent to a remote VLAN via Gi1/0/24.. This is an RSPAN source session on SW5. Source ports Gi1/0/1-3 capture both directions. The destination port Gi1/0/24 uses Replicate encapsulation, which is typical for RSPAN to send mirrored traffic to a remote VLAN. This switch is the source of the RSPAN session.

Answer

This is a local SPAN session that sends traffic to Gi1/0/24.

Answer

The destination port Gi1/0/24 is used to receive mirrored traffic from another switch.

Answer

Only egress traffic from Gi1/0/1-3 is captured.

Question 15

A network engineer runs the following command on Switch SW6:

SW6# show monitor session 6
Session 6
---------
Type                   : Remote Destination Session
Source RSPAN VLAN      : 200
Destination Ports      : Gi1/0/12
    Encapsulation      : Native
    Ingress            : Disabled

Based on this output, what can be concluded?

Accepted Answer

This switch receives mirrored traffic from RSPAN VLAN 200 and sends it to Gi1/0/12.. This is an RSPAN destination session on SW6. The source is RSPAN VLAN 200, and the destination port Gi1/0/12 sends out the mirrored traffic. The destination port has Native encapsulation and ingress disabled, meaning it only forwards traffic from the RSPAN VLAN.

Answer

This is a local SPAN session with source VLAN 200.

Answer

The RSPAN VLAN 200 is used to send traffic to a remote switch.

Answer

Ingress traffic on Gi1/0/12 is forwarded to the RSPAN VLAN.