Home > SPAN Questions 2

SPAN Questions 2

September 6th, 2017 in SWITCH 300-115 Go to comments

Question 1

Question 2

Question 3


A physical port that belongs to an EtherChannel group can be configured as a SPAN source port and still be a part of the EtherChannel. In this case, data from the physical port is monitored as it participates in the EtherChannel. However, if a physical port that belongs to an EtherChannel group is configured as a SPAN destination, it is removed from the group.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swspan.html

Question 4


Remote SPAN (RSPAN) is used when source ports are not located on the same switch as the Destination port. RSPAN is an advanced feature that requires a special VLAN to carry the monitored traffic and is not supported by all switches.

The Configuring SPAN and RSPAN link (http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_40_se/configuration/guide/scg/swspan.pdf) mentions about two things:

+ We recommend that you configure an RSPAN VLAN before you configure an RSPAN source or a destination session.
+ First create a new VLAN to be the RSPAN VLAN for the RSPAN session

But this question asks about “Cisco recommendation” so answer C is the better one.

Question 5

Question 6


The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. It has these special characteristics:
+ All traffic in the RSPAN VLAN is always flooded.
+ No MAC address learning occurs on the RSPAN VLAN.
+ RSPAN VLAN traffic only flows on trunk ports.
+ RSPAN VLANs must be configured in VLAN configuration mode by using the remote-span VLAN configuration mode command.
+ STP can run on RSPAN VLAN trunks but not on SPAN destination ports.
+ An RSPAN VLAN cannot be a private-VLAN primary or secondary VLAN.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750e_3560e/software/release/12-2_55_se/configuration/guide/3750escg/swspan.pdf

Question 7


RSPAN extends SPAN by enabling remote monitoring of multiple switches across your network. The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating switches (therefore answer B is correct). The SPAN traffic from the sources is copied onto the RSPAN VLAN through a reflector port and then forwarded over trunk ports that are carrying the RSPAN VLAN to any RSPAN destination session monitoring the RSPAN VLAN.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_11_yj4/configuration/guide/lrescg/swspan.html

The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. One of the special characteristics is “No MAC address learning occurs on the RSPAN VLAN”.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750e_3560e/software/release/12-2_55_se/configuration/guide/3750escg/swspan.pdf

Question 8


A destination port has these characteristics:

+ …
+ It does not participate in any of the Layer 2 protocols (STP, VTP, CDP, DTP, PagP).

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swspan.html

  1. Anonymous
    July 7th, 2017

    Where are the questions?

  2. Andrew
    October 31st, 2017

    I think question 5 should be : A and B

    SPAN sessions (local or remote) allow you to monitor traffic on one or more ports, or one or more VLANs, and send the monitored traffic to one or more destination ports.

    A local SPAN session is an association of a destination port with source ports or source VLANs, all on a single network device. Local SPAN does not have separate source and destination sessions. Local SPAN sessions gather a set of ingress and egress packets specified by the user and form them into a stream of SPAN data, which is directed to the destination port.

  3. switchy
    November 1st, 2017

    @Andrew, B is not correct because it can monitor both rx/tx traffic.
    In the question, B says “It can monitor only traffic that ingresses or egresses on the source interface or VLAN” which implies one or the other but not both and this is wrong.

  4. Andrew
    November 1st, 2017

    I understand the word “ONLY” if the admin chooses to do so. It doesn’t mean that you can’t do both.

    D is definitely wrong because you can have multiple sources in one session.

    monitor session 1 source VLAN 1 , 100 both
    monitor session 1 destination interface Gi0/10

  5. Al
    November 13th, 2017

    Q 5

  6. Al
    November 13th, 2017

    @switchy and Andrew
    Andrew is right. I think the word “only” refers to “source interface or VLAN” rather than “ingresses or egresses”.
    What the option B means is that you can not mix source interfaces with VLANs for monitor session source.

  7. mori
    November 15th, 2017

    routed ports can be configured as SPAN sources , so it shouldnd be layer 2 !!?

  8. Anonymous
    November 19th, 2017

    Q1 and Q7 contradicts each other

  9. Marcus
    December 9th, 2017

    Why in Q2 answer A is correct? SPAN destination port doesn’t learn MAC-addresses, it’s removes VLAN tags and doesn’t making forwarding decisions. It doesn’t look as “normal” L2 port. May be B is correct? (only source port works as L2).

  1. No trackbacks yet.