hardMultiple ChoiceObjective-mapped
300-410 Practice Question: Configures an ERSPAN session on a Cisco router to…
A network engineer configures an ERSPAN session on a Cisco router to monitor traffic on interface GigabitEthernet0/0/0 and send it to a monitoring server at 172.16.1.100. The engineer uses the command 'monitor session 1 type erspan-source' and configures the tunnel. The monitoring server receives packets, but the packets contain only the original source and destination IP addresses of the monitored traffic, not the encapsulated GRE headers. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ERSPAN session is misconfigured, causing the router to forward the original packets instead of encapsulated copies.
ERSPAN encapsulates the original packet with a GRE header. If the monitoring server receives packets without GRE encapsulation, it means the router is not encapsulating the traffic correctly, possibly because the ERSPAN session is not configured with the correct tunnel source or destination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The ERSPAN session is misconfigured, causing the router to forward the original packets instead of encapsulated copies.
Why this is correct
Correct because the router should send GRE-encapsulated packets; if it sends raw packets, the session configuration is incorrect.
- ✗
The monitoring server is stripping the GRE headers before capturing.
Why it's wrong here
Incorrect because the server would need to decapsulate; the issue is that the router is not encapsulating.
- ✗
The ERSPAN session is configured with the 'ip access-group' command that filters the encapsulated traffic.
Why it's wrong here
Incorrect because access-lists could drop packets, but they would not cause the router to send raw packets.
- ✗
The router is not running the correct IOS version that supports ERSPAN.
Why it's wrong here
Incorrect because the session was configured; the issue is likely a configuration error, not a software limitation.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.