200-155 · Question #81
Which statements are valid for a local SPAN configuration'? (Choose two.)
The correct answer is A. Source and destination interface must be on the same host D. Destination interface can be a physical port. For a local SPAN (Switched Port Analyzer) configuration, both the source and destination interfaces must reside on the same network device. The destination for the mirrored traffic can be a physical port, allowing external devices to capture the monitored data.
Question
Which statements are valid for a local SPAN configuration'? (Choose two.)
Options
- ASource and destination interface must be on the same host
- BSource and destination interfaces can be on different hosts
- CDestination vEthernet interface can be on a different VLAN than the source
- DDestination interface can be a physical port
- EDestination interface cannot be a physical port
How the community answered
(28 responses)- A89% (25)
- B4% (1)
- C7% (2)
Why each option
For a local SPAN (Switched Port Analyzer) configuration, both the source and destination interfaces must reside on the same network device. The destination for the mirrored traffic can be a physical port, allowing external devices to capture the monitored data.
For a local SPAN configuration, the source interface (where traffic is being monitored) and the destination interface (where the monitored traffic is sent) must exist on the same switch or network device. This limitation ensures that the traffic mirroring is handled by a single device's resources.
This statement is incorrect because local SPAN specifically requires the source and destination interfaces to be on the *same* network device, unlike Remote SPAN (RSPAN) or Encapsulated Remote SPAN (ERSPAN).
While a destination interface can be a vEthernet interface, in a local SPAN, the mirrored traffic typically retains its original VLAN information, and the destination is not configured to be on a different VLAN than the source traffic itself.
A physical port is a valid destination for SPAN traffic, allowing a network analyzer or intrusion detection system to be connected directly to capture the mirrored data. This is a common setup for network troubleshooting and security monitoring.
This statement contradicts the capabilities of local SPAN, as a physical port is a common and supported destination for mirrored traffic, used to connect monitoring equipment.
Concept tested: Local SPAN configuration characteristics
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/cg/spansl.html
Topics
Community Discussion
No community discussion yet for this question.