350-601 · Question #383
Refer to the exhibit. The communication between the web server and the application server experiences poor performance. The network engineer must collect the traffic between the two servers…
The correct answer is A. Configure an ERSPAN session between N5K-1 and N5K-2. To capture full traffic, including payload, between servers at a remote site and send it to a central monitoring location, an Encapsulated Remote SPAN (ERSPAN) session is required. ERSPAN allows mirrored traffic to be encapsulated and routed across an IP network.
Question
Refer to the exhibit. The communication between the web server and the application server experiences poor performance. The network engineer must collect the traffic between the two servers, including the payload for more investigation. The collected data must be sent from the remote site to the headquarters. Which action accomplishes this goal?
Exhibit
Options
- AConfigure an ERSPAN session between N5K-1 and N5K-2.
- BConfigure a SPAN session between N5K-1 and N5K-2
- CConfigure SNMP on N5K-1 to send the data to the monitor server
- DConfigure NetFlow on N5K-1 to send the data to the monitor server
How the community answered
(41 responses)- A83% (34)
- B2% (1)
- C5% (2)
- D10% (4)
Why each option
To capture full traffic, including payload, between servers at a remote site and send it to a central monitoring location, an Encapsulated Remote SPAN (ERSPAN) session is required. ERSPAN allows mirrored traffic to be encapsulated and routed across an IP network.
ERSPAN (Encapsulated Remote SPAN) is designed to mirror traffic from source ports or VLANs and encapsulate it in a GRE tunnel, allowing it to be sent across a Layer 3 network to a remote destination for analysis. This method captures the full payload and can transmit it from a remote site to headquarters.
A local SPAN (Switched Port Analyzer) session only mirrors traffic within the same switch and cannot send it across a Layer 3 network to a remote site.
SNMP (Simple Network Management Protocol) collects management information and statistics, not full data plane traffic including payload.
NetFlow (or IPFIX) collects flow statistics (source/destination IP, port, protocol, byte/packet counts) but does not capture the actual payload of the traffic.
Concept tested: ERSPAN for remote traffic mirroring
Source: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/span/503_n1_1/N5K-N2K_SPAN_Config_Guide_503N1_1/N5K_N2K_SPAN_Config_Guide_503N1_1_chapter2.html
Topics
Community Discussion
No community discussion yet for this question.