350-401 Question 219
Single answerYou are tasked with monitoring traffic from multiple interfaces on a switch and sending the mirrored traffic to a remote destination for analysis. The remote analyzer is located in a different Layer 3 network. Which technology is best suited for this requirement?
- A
SPAN (Switched Port Analyzer)
- B
RSPAN (Remote Switched Port Analyzer)
- C
ERSPAN (Encapsulated Remote Switched Port Analyzer)
- D
NetFlow
Show answer and explanation
Correct answer: C
Explanation
ERSPAN is the best solution for scenarios requiring traffic mirroring across Layer 3 networks. Unlike SPAN and RSPAN, which are limited to the local switch or Layer 2 networks, ERSPAN uses GRE encapsulation to forward mirrored traffic to remote destinations in different Layer 3 networks.
- A. Incorrect.
SPAN is used to mirror traffic from one or more interfaces to a local destination port on the same switch. It does not support sending traffic across Layer 3 networks.
- B. Incorrect.
RSPAN extends SPAN functionality by allowing mirrored traffic to be sent across multiple switches, but it is limited to Layer 2 transport and cannot be used across Layer 3 networks.
- C. Correct.
ERSPAN enables traffic mirroring across Layer 3 networks by encapsulating mirrored traffic in GRE (Generic Routing Encapsulation) packets. This makes it suitable for scenarios involving remote destinations in different Layer 3 networks.
- D. Incorrect.
NetFlow is a flow monitoring tool used for traffic analysis and statistics collection. It is not designed for packet mirroring or traffic forwarding like SPAN/RSPAN/ERSPAN.