SPAN, RSPAN, ERSPAN

Question 1

What does SPAN mean?

Answer 1

Switchport Analyzer - this is basically just mirroring a switchport

Question 2

What are the three types of SPANs and what is the difference between each one?

Answer 2

SPAN - capture on a local switch

RSPAN - capture on a remote switch

ERSPAN - capture on a remote network

Question 3

What commands would you use to configure a Cisco switch to mirror ports fa0/1 and fa0/2 and send the traffic to fa0/24?

Answer 3

SWITCH1# conf t

SWITCH1(config)# monitor session 1 source interface fastEthernet 0/1 - 2

SWITCH1(config)# monitor session 1 destination interface fastEthernet 0/24

Question 4

What command would you use to see how many span sessions are supported on the switch at once?

Answer 4

SWITCH1(config)# monitor session ?

Question 5

What is the key configuration element you need to configure to perform RSPAN?

Answer 5

A dedicated VLAN must be established on the source and destination switches and permitted across the trunk.

Question 6

What commands would you need to configure RSPAN from the source ports of Switch2 on fa0/1 and fa0/2 to the destination port of fa0/24 on Switch1?

Answer 6

SWITCH2(config)# vlan 99

SWITCH2(config-vlan)# remote-span

SWITCH2(config)# monitor session 1 source interface fastEthernet 0/1 - 2

SWITCH2(config)# monitor session 1 destination remote vlan 99

SWITCH1(config)# vlan 99

SWITCH1(config-vlan)# remote-span

SWITCH1(config)# monitor session 1 source remote vlan 99

SWITCH1(config)# monitor session 1 destination fastEthernet 0/24

Question 7

What commands are needed to configure ERSPAN on a remote switch?

Answer 7

RemoteSW1(config)# monitor session 1 type erspan-source

RemoteSW1(config-mon-erspan-src)# source interface gi0/10 both

RemoteSW1(config-mon-erspan-src)# no shut

RemoteSW1(config-mon-erspan-src)# destination

RemoteSW1(config-mon-erspan-src-dst)# ip address <ip></ip>

RemoteSW1(config-mon-erspan-src-dst)# erspan-id 2

RemoteSW1(config-mon-erspan-src-dst)# origin ip <ip></ip>

Question 8

What commands are needed to configure ERSPAN on the local switch?

Answer 8

LocalSW1(config)# monitor session 1 type erspan-destination

LocalSW1(config-mon-erspan-dst)# no shut

LocalSW1(config-mon-erspan-dst)# destination interface gigabitEthernet 0/2

LocalSW1(config-mon-erspan-dst)# source

LocalSW1(config-mon-erspan-dst-src)# erspan-id 2

LocalSW1(config-mon-erspan-dst-src)# ip address <ip></ip>

LocalSW1(config-mon-erspan-dst-src)# origin ip address <ip></ip>

Question 9

What show command(s) can you use to verify a SPAN session is running?

Answer 9

show monitor session all

show monitor session <session></session>