mediumMultiple Choice
300-410 Practice Question: Consider the ERSPAN configuration on a router:…
Consider the ERSPAN configuration on a router:
monitor session 1 type erspan-source source interface GigabitEthernet0/0/1 both destination erspan-id 1
ip address 192.168.1.100
origin ip address 192.168.1.1
What is the primary purpose of the 'origin ip address' command?
⚠ Common exam trap
The trap is confusing the origin IP (source of ERSPAN traffic) with the destination IP (monitoring device) or the monitored interface IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It defines the source IP address used in the ERSPAN GRE encapsulation.
The 'origin ip address' command in ERSPAN configuration specifies the source IP address that will be used in the ERSPAN GRE encapsulation. This IP address is typically the loopback or management interface of the source switch or router, and it identifies the origin of the ERSPAN traffic to the destination monitoring device. It is not the destination IP address, nor the monitored interface IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It specifies the IP address of the monitoring device.
Why it's wrong here
The origin ip address identifies the ERSPAN source switch or router that encapsulates and forwards the mirrored traffic, not the receiving monitoring device. It is tempting because the destination ip address does name the collector, so engineers assume origin mirrors that role; instead origin populates the ERSPAN header's source field for the analyser.
- ✓
It defines the source IP address used in the ERSPAN GRE encapsulation.
Why this is correct
The origin IP address sets the source address inside the ERSPAN GRE header, identifying the originating switch to the destination analyser. It satisfies the requirement to define the encapsulation source, distinct from the destination ip address, which is the tunnel endpoint receiving the mirrored frames.
- ✗
It sets the IP address of the interface being monitored.
Why it's wrong here
The monitored interface is named by the source interface command (GigabitEthernet0/0/1); origin ip address instead sets the source IP placed in the ERSPAN header. It is tempting because both commands reference the traffic's origin, but origin ip address identifies the encapsulating device, not the port being mirrored.
- ✗
It enables ERSPAN on the specified interface.
Why it's wrong here
The origin IP identifies the source address of the ERSPAN packet's outer header, so the collector can distinguish streams; it does not activate monitoring on an interface, which the source command already does. It is tempting because session commands configure the whole feature, but enabling ERSPAN is achieved by defining the source interface.
Go deeper
Related to this question
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.