350-401 Question 217
Single answerA network administrator is tasked with configuring a switch to monitor traffic from multiple VLANs and send the mirrored traffic to a remote analyzer device across the network. Which feature should the administrator use to meet this requirement?
- A
SPAN
- B
RSPAN
- C
ERSPAN
- D
NetFlow
Show answer and explanation
Correct answer: C
Explanation
To monitor traffic from multiple VLANs and send the mirrored traffic to a remote analyzer device, the administrator should use ERSPAN. ERSPAN extends the capabilities of SPAN and RSPAN by encapsulating mirrored traffic in a GRE tunnel, allowing it to be delivered across Layer 3 boundaries to a remote destination. SPAN and RSPAN are limited to local or Layer 2 domains, and NetFlow is not relevant for traffic mirroring.
- A. Incorrect.
SPAN (Switched Port Analyzer) is used to mirror traffic to a local port on the same switch, but it does not support remote monitoring across the network.
- B. Incorrect.
RSPAN (Remote SPAN) can mirror traffic across switches in the same Layer 2 domain by using a special RSPAN VLAN, but it does not send traffic to a remote analyzer device over Layer 3.
- C. Correct.
ERSPAN (Encapsulated Remote SPAN) is the correct choice because it encapsulates mirrored traffic in a GRE tunnel and sends it over Layer 3 to a remote analyzer device.
- D. Incorrect.
NetFlow is used for flow-based monitoring and analysis, not for mirroring traffic to a remote analyzer.