Home > SPAN Questions 2

SPAN Questions 2

September 6th, 2017 in SWITCH 300-115 Go to comments

Question 1

Question 2

Question 3

Explanation

A physical port that belongs to an EtherChannel group can be configured as a SPAN source port and still be a part of the EtherChannel. In this case, data from the physical port is monitored as it participates in the EtherChannel. However, if a physical port that belongs to an EtherChannel group is configured as a SPAN destination, it is removed from the group.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swspan.html

Question 4

Explanation

Remote SPAN (RSPAN) is used when source ports are not located on the same switch as the Destination port. RSPAN is an advanced feature that requires a special VLAN to carry the monitored traffic and is not supported by all switches.

The Configuring SPAN and RSPAN link (http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_40_se/configuration/guide/scg/swspan.pdf) mentions about two things:

+ We recommend that you configure an RSPAN VLAN before you configure an RSPAN source or a destination session.
+ First create a new VLAN to be the RSPAN VLAN for the RSPAN session

But this question asks about “Cisco recommendation” so answer C is the better one.

Question 5

Question 6

Explanation

The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. It has these special characteristics:
+ All traffic in the RSPAN VLAN is always flooded.
+ No MAC address learning occurs on the RSPAN VLAN.
+ RSPAN VLAN traffic only flows on trunk ports.
+ RSPAN VLANs must be configured in VLAN configuration mode by using the remote-span VLAN configuration mode command.
+ STP can run on RSPAN VLAN trunks but not on SPAN destination ports.
+ An RSPAN VLAN cannot be a private-VLAN primary or secondary VLAN.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750e_3560e/software/release/12-2_55_se/configuration/guide/3750escg/swspan.pdf

Question 7

Explanation

RSPAN extends SPAN by enabling remote monitoring of multiple switches across your network. The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating switches (therefore answer B is correct). The SPAN traffic from the sources is copied onto the RSPAN VLAN through a reflector port and then forwarded over trunk ports that are carrying the RSPAN VLAN to any RSPAN destination session monitoring the RSPAN VLAN.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_11_yj4/configuration/guide/lrescg/swspan.html

The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. One of the special characteristics is “No MAC address learning occurs on the RSPAN VLAN”.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750e_3560e/software/release/12-2_55_se/configuration/guide/3750escg/swspan.pdf

Question 8

Explanation

A destination port has these characteristics:

+ …
+ It does not participate in any of the Layer 2 protocols (STP, VTP, CDP, DTP, PagP).

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swspan.html

Question 9

Explanation

The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. It has these special characteristics:
+ All traffic in the RSPAN VLAN is always flooded.
+ No MAC address learning occurs on the RSPAN VLAN.
+ RSPAN VLAN traffic only flows on trunk ports.
+ RSPAN VLANs must be configured in VLAN configuration mode by using the remote-span VLAN configuration mode command.
+ STP can run on RSPAN VLAN trunks but not on SPAN destination ports.
+ An RSPAN VLAN cannot be a private-VLAN primary or secondary VLAN.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750e_3560e/software/release/12-2_55_se/configuration/guide/3750escg/swspan.pdf

Question 10

Comments
  1. Anonymous
    July 7th, 2017

    Where are the questions?

  2. Andrew
    October 31st, 2017

    I think question 5 should be : A and B

    SPAN sessions (local or remote) allow you to monitor traffic on one or more ports, or one or more VLANs, and send the monitored traffic to one or more destination ports.

    A local SPAN session is an association of a destination port with source ports or source VLANs, all on a single network device. Local SPAN does not have separate source and destination sessions. Local SPAN sessions gather a set of ingress and egress packets specified by the user and form them into a stream of SPAN data, which is directed to the destination port.

  3. switchy
    November 1st, 2017

    @Andrew, B is not correct because it can monitor both rx/tx traffic.
    In the question, B says “It can monitor only traffic that ingresses or egresses on the source interface or VLAN” which implies one or the other but not both and this is wrong.

  4. Andrew
    November 1st, 2017

    @switchy
    I understand the word “ONLY” if the admin chooses to do so. It doesn’t mean that you can’t do both.

    D is definitely wrong because you can have multiple sources in one session.

    monitor session 1 source VLAN 1 , 100 both
    monitor session 1 destination interface Gi0/10

  5. Al
    November 13th, 2017

    Q 5
    AB

  6. Al
    November 13th, 2017

    @switchy and Andrew
    Andrew is right. I think the word “only” refers to “source interface or VLAN” rather than “ingresses or egresses”.
    What the option B means is that you can not mix source interfaces with VLANs for monitor session source.

  7. mori
    November 15th, 2017

    Q2.
    routed ports can be configured as SPAN sources , so it shouldnd be layer 2 !!?

  8. Anonymous
    November 19th, 2017

    Q1 and Q7 contradicts each other

  9. Marcus
    December 9th, 2017

    Why in Q2 answer A is correct? SPAN destination port doesn’t learn MAC-addresses, it’s removes VLAN tags and doesn’t making forwarding decisions. It doesn’t look as “normal” L2 port. May be B is correct? (only source port works as L2).

  10. Alex
    December 12th, 2017

    I think Andrew is right i just checked in my Switch:

    monitor session 1 source interface Gi1/0/10 – 11
    monitor session 1 destination interface Gi1/0/12

    In the other hand you can only set one destination per session.

    The best answer is A and B, although B is not entire correct since you can monitor both ingress and egress.

  11. Alex
    December 12th, 2017

    *Ignore the part that you can only set one per session.

  12. wasntme
    December 14th, 2017

    @Marcus: I think that correct option is C ” Destination ports SPAN work on L2 (Layer 2)”. Because src_port can run on L3 as routed and rest make no sense :)

  13. CoanX
    December 21st, 2017

    Certprepare team,
    Can you guys correct the Q5 and change the answer to AB? Option D is obviously wrong as the SPAN session supports more than one source VLAN or interface.

    Or are you guys sure that this is the right answer for cisco?

  14. Marcus
    December 23rd, 2017

    @wasntme, I guess C in Q2 can’t be correct, because it says “ports”, but each session can have only one destination port. ;)

  15. Marcus
    December 23rd, 2017

    @CoanX, yes, AB for Q5 are correct. IPhelper’s dump says the same.

  16. Pipo
    December 23rd, 2017

    Which statement about frame SPAN is true?
    answer: Destination and source port SPAN works on L2 (layer 2)

    Which statement about layer 2 protocol participation of ports involved in a SPAN session is true?
    answer: A SPAN destination doesn’t participate in any layer 2 protocols

    Both are in IPHELPER_December_2017. Which one is not correct? I think the first is not correct

  17. Anon6
    December 24th, 2017

    Q2 is probably wrong in the question. Never heard of ‘frame’ span. Local, Rspan, and ERspan.
    Most SPANS are L2 systems. L3 is only for ERSPAN.

    https://supportforums.cisco.com/t5/network-infrastructure-documents/understanding-span-rspan-and-erspan/ta-p/3144951

  18. Vaj
    January 21st, 2018

    Can anyone please explain Q1 answer?
    Question about RSPAN
    A. RSPAN VLAN carries only RSPAN traffic
    B. On a switch there can be only one RSPAN VLAN
    C. RSPAN VLAN carries RSPAN traffic along multiple switches

    A and C seem to be correct

  19. Grishazahid
    April 16th, 2018

    Vaj @ January 21st, 2018
    I think they mean about STP in question 1 answer A. So answer C is more correct than A
    But answer A in q conflicts with Question 7

  1. No trackbacks yet.