Home > SPAN Questions 2

SPAN Questions 2

September 6th, 2017 in SWITCH 300-115 Go to comments

Question 1

Question 2

Question 3

Explanation

A physical port that belongs to an EtherChannel group can be configured as a SPAN source port and still be a part of the EtherChannel. In this case, data from the physical port is monitored as it participates in the EtherChannel. However, if a physical port that belongs to an EtherChannel group is configured as a SPAN destination, it is removed from the group.

Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swspan.html

Question 4

Explanation

Remote SPAN (RSPAN) is used when source ports are not located on the same switch as the Destination port. RSPAN is an advanced feature that requires a special VLAN to carry the monitored traffic and is not supported by all switches.

The Configuring SPAN and RSPAN link (http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_40_se/configuration/guide/scg/swspan.pdf) mentions about two things:

+ We recommend that you configure an RSPAN VLAN before you configure an RSPAN source or a destination session.
+ First create a new VLAN to be the RSPAN VLAN for the RSPAN session

But this question asks about “Cisco recommendation” so answer C is the better one.

Question 5

Question 6

Explanation

The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. It has these special characteristics:
+ All traffic in the RSPAN VLAN is always flooded.
+ No MAC address learning occurs on the RSPAN VLAN.
+ RSPAN VLAN traffic only flows on trunk ports.
+ RSPAN VLANs must be configured in VLAN configuration mode by using the remote-span VLAN configuration mode command.
+ STP can run on RSPAN VLAN trunks but not on SPAN destination ports.
+ An RSPAN VLAN cannot be a private-VLAN primary or secondary VLAN.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750e_3560e/software/release/12-2_55_se/configuration/guide/3750escg/swspan.pdf

Question 7

Explanation

RSPAN extends SPAN by enabling remote monitoring of multiple switches across your network. The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating switches (therefore answer B is correct). The SPAN traffic from the sources is copied onto the RSPAN VLAN through a reflector port and then forwarded over trunk ports that are carrying the RSPAN VLAN to any RSPAN destination session monitoring the RSPAN VLAN.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_11_yj4/configuration/guide/lrescg/swspan.html

The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. One of the special characteristics is “No MAC address learning occurs on the RSPAN VLAN”.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750e_3560e/software/release/12-2_55_se/configuration/guide/3750escg/swspan.pdf

Question 8

Explanation

A destination port has these characteristics:

+ …
+ It does not participate in any of the Layer 2 protocols (STP, VTP, CDP, DTP, PagP).

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swspan.html

Question 9

Explanation

The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. It has these special characteristics:
+ All traffic in the RSPAN VLAN is always flooded.
+ No MAC address learning occurs on the RSPAN VLAN.
+ RSPAN VLAN traffic only flows on trunk ports.
+ RSPAN VLANs must be configured in VLAN configuration mode by using the remote-span VLAN configuration mode command.
+ STP can run on RSPAN VLAN trunks but not on SPAN destination ports.
+ An RSPAN VLAN cannot be a private-VLAN primary or secondary VLAN.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750e_3560e/software/release/12-2_55_se/configuration/guide/3750escg/swspan.pdf

Question 10

Comments
  1. Anonymous
    July 7th, 2017

    Where are the questions?

  2. Andrew
    October 31st, 2017

    I think question 5 should be : A and B

    SPAN sessions (local or remote) allow you to monitor traffic on one or more ports, or one or more VLANs, and send the monitored traffic to one or more destination ports.

    A local SPAN session is an association of a destination port with source ports or source VLANs, all on a single network device. Local SPAN does not have separate source and destination sessions. Local SPAN sessions gather a set of ingress and egress packets specified by the user and form them into a stream of SPAN data, which is directed to the destination port.

  3. switchy
    November 1st, 2017

    @Andrew, B is not correct because it can monitor both rx/tx traffic.
    In the question, B says “It can monitor only traffic that ingresses or egresses on the source interface or VLAN” which implies one or the other but not both and this is wrong.

  4. Andrew
    November 1st, 2017

    @switchy
    I understand the word “ONLY” if the admin chooses to do so. It doesn’t mean that you can’t do both.

    D is definitely wrong because you can have multiple sources in one session.

    monitor session 1 source VLAN 1 , 100 both
    monitor session 1 destination interface Gi0/10

  5. Al
    November 13th, 2017

    Q 5
    AB

  6. Al
    November 13th, 2017

    @switchy and Andrew
    Andrew is right. I think the word “only” refers to “source interface or VLAN” rather than “ingresses or egresses”.
    What the option B means is that you can not mix source interfaces with VLANs for monitor session source.

  7. mori
    November 15th, 2017

    Q2.
    routed ports can be configured as SPAN sources , so it shouldnd be layer 2 !!?

  8. Anonymous
    November 19th, 2017

    Q1 and Q7 contradicts each other

  9. Marcus
    December 9th, 2017

    Why in Q2 answer A is correct? SPAN destination port doesn’t learn MAC-addresses, it’s removes VLAN tags and doesn’t making forwarding decisions. It doesn’t look as “normal” L2 port. May be B is correct? (only source port works as L2).

  10. Alex
    December 12th, 2017

    I think Andrew is right i just checked in my Switch:

    monitor session 1 source interface Gi1/0/10 – 11
    monitor session 1 destination interface Gi1/0/12

    In the other hand you can only set one destination per session.

    The best answer is A and B, although B is not entire correct since you can monitor both ingress and egress.

  11. Alex
    December 12th, 2017

    *Ignore the part that you can only set one per session.

  12. wasntme
    December 14th, 2017

    @Marcus: I think that correct option is C ” Destination ports SPAN work on L2 (Layer 2)”. Because src_port can run on L3 as routed and rest make no sense :)

  13. CoanX
    December 21st, 2017

    Certprepare team,
    Can you guys correct the Q5 and change the answer to AB? Option D is obviously wrong as the SPAN session supports more than one source VLAN or interface.

    Or are you guys sure that this is the right answer for cisco?

  14. Marcus
    December 23rd, 2017

    @wasntme, I guess C in Q2 can’t be correct, because it says “ports”, but each session can have only one destination port. ;)

  15. Marcus
    December 23rd, 2017

    @CoanX, yes, AB for Q5 are correct. IPhelper’s dump says the same.

  16. Pipo
    December 23rd, 2017

    Which statement about frame SPAN is true?
    answer: Destination and source port SPAN works on L2 (layer 2)

    Which statement about layer 2 protocol participation of ports involved in a SPAN session is true?
    answer: A SPAN destination doesn’t participate in any layer 2 protocols

    Both are in IPHELPER_December_2017. Which one is not correct? I think the first is not correct

  17. Anon6
    December 24th, 2017

    Q2 is probably wrong in the question. Never heard of ‘frame’ span. Local, Rspan, and ERspan.
    Most SPANS are L2 systems. L3 is only for ERSPAN.

    https://supportforums.cisco.com/t5/network-infrastructure-documents/understanding-span-rspan-and-erspan/ta-p/3144951

  18. Vaj
    January 21st, 2018

    Can anyone please explain Q1 answer?
    Question about RSPAN
    A. RSPAN VLAN carries only RSPAN traffic
    B. On a switch there can be only one RSPAN VLAN
    C. RSPAN VLAN carries RSPAN traffic along multiple switches

    A and C seem to be correct

  19. Grishazahid
    April 16th, 2018

    Vaj @ January 21st, 2018
    I think they mean about STP in question 1 answer A. So answer C is more correct than A
    But answer A in q conflicts with Question 7

  20. lalaversa
    May 5th, 2018

    Q5.
    Another fake Q&A… each SPAN session supports more source (VLAN or interface) then D can not be right. SPAN session supports only one destination SPAN interface.
    In answer B “only traffic that ingress or egress” not exclude one or the other but indicate that the monitored traffic can be ingress or egress (without deleting the option “both”… I think).
    The correct answers are A & B.

  21. lalaversa
    May 5th, 2018

    Q2.
    A SPAN destination does not partecipate in any Layer 2 protocols (see correct answer in Q8 in this Q&A block !!!). Source port could work on L2 protocol (this exclude answer D).
    Then in Q2 the only correct answer is “B”.

  22. Ahmed B.
    May 16th, 2018

    Q5 >> indeed answer D is wrong

    (D. Each SPAN session supports only one source VLAN or interface)

    >>>> “You can monitor multiple source ports in a single session.”

    https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swspan.html

  23. Ahmed B.
    May 16th, 2018

    Q2 >> also answer A is wrong
    (A. Destination and source port SPAN works on L2 (Layer 2))

    “SPAN does not affect the switching of network traffic on the source ports or VLANs. You must dedicate the destination port for SPAN use. Except for traffic that is required for the SPAN or RSPAN session, destination ports do not receive or forward traffic”

    “It does not participate in any of the Layer 2 protocols (STP, VTP, CDP, DTP, PagP).”

    https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swspan.html

  24. 465sa11
    May 30th, 2018

    New 100% Real CCNP Exam Questions

    dumps
    pro
    dot
    com

  25. patzen
    May 30th, 2018

    @lalaversa I think your logic here might be wrong, Q2 answer D reads:

    D. Destination and source port SPAN don’t work on L2 — they used AND which means both conditions would have to be met

  26. patzen
    May 30th, 2018

    Q5 is well confusing, I would assume here A E is correct but that only if the switch is 2950 which can only have one span session active at a time

  27. Q5
    July 26th, 2018

    D. Each SPAN session supports only one source VLAN or interface

    If my english is not failing here they might mean that you can’t use a mix of vlans and interfaces as source in one session

    so your source contains either physical interfaces or vlans but not a mix of both if that makes sense

  28. RED1
    August 15th, 2018

    Q.5 it is clear that SPAN support multiple source (Vlan or Interface) but not mix of the two. Chose Vlans or interfaces, not mix of them. So
    D. Each SPAN session supports only one source VLAN or interface D.is incorrect

    Response is: A,B

  29. real arse taker
    October 5th, 2018

    RSPAN VLAN – carries RSPAN traffic only is correct answer – then incorrect ?

  1. No trackbacks yet.