350-401 Question 220
Single answerA network administrator wants to monitor traffic from specific VLANs on multiple switches in a network and requires the mirrored traffic to be sent to a remote monitoring device over an IP network. Which technology would best meet this requirement?
- A
SPAN
- B
RSPAN
- C
ERSPAN
- D
NetFlow
Show answer and explanation
Correct answer: C
Explanation
ERSPAN is the best solution for the given scenario because it allows traffic from specific VLANs on multiple switches to be mirrored and sent over an IP network to a remote monitoring device. SPAN and RSPAN do not support traffic encapsulation over an IP network, and NetFlow is not designed for traffic mirroring.
- A. Incorrect.
SPAN (Switched Port Analyzer) is used for local traffic mirroring on the same switch and does not support sending mirrored traffic to remote devices over an IP network.
- B. Incorrect.
RSPAN (Remote SPAN) allows traffic to be mirrored across multiple switches, but it still uses VLANs for transport and does not send mirrored traffic over an IP network.
- C. Correct.
ERSPAN (Encapsulated Remote SPAN) supports sending mirrored traffic to remote monitoring devices over an IP network using GRE encapsulation. This makes it the correct choice for the scenario.
- D. Incorrect.
NetFlow is used for traffic flow analysis and does not mirror traffic for monitoring purposes, so it is not applicable in this scenario.