Which feature must be configured to allow packet capture over Layer 3 infrastructure'?

Question

Options

• AVSPAN
• BIPSPAN
• CRSPAN
• DERSPAN

• A
  5% (1)
• B
  5% (1)
• D
  91% (20)

Explanation

ERSPAN (Encapsulated Remote SPAN) is the correct answer because it encapsulates mirrored traffic in GRE (Generic Routing Encapsulation) packets, allowing captured traffic to traverse Layer 3 (routed) networks and be sent to a remote analyzer across different IP subnets or even across the internet.

Why the distractors are wrong:

• VSPAN (A) is VLAN-based SPAN that only mirrors traffic within a local VLAN on the same switch - it has no remote capability.
• IPSPAN (B) is not a real or standard Cisco networking feature; it is a fabricated distractor.
• RSPAN (C) is Remote SPAN, which can send mirrored traffic to a remote device, but it operates only at Layer 2 using a dedicated VLAN, meaning it cannot cross routed Layer 3 boundaries.

Memory Tip: Think of the "E" in ERSPAN as "Everywhere" - the encapsulation (GRE) allows the captured packets to travel everywhere across Layer 3 infrastructure, just like regular routed IP traffic. If you need to cross a router, you need ERSPAN!

No community discussion yet for this question.