SPAN Questions 3

Question 1

Question 2

Explanation

Mixed stacks are not supported with switches running the LAN base feature set -> C is not correct.

Switch stacks running the LAN base feature set do not support Layer 3 features -> E is not correct.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/15-0_1_se/configuration/guide/3750xcg/swstack.pdf

Note: Homogeneous stack: A Catalyst 3750-E-only stack with only Catalyst 3750-E switches as stack members or a Catalyst 3750-X-only stack with only Catalyst 3750-X switches as stack members.

One of the switches controls the operation of the stack and is called the stack master. The stack master and the other switches in the stack are all stack members -> D is not correct.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swstack.pdf

Question 3

Question 4

Explanation

RSPAN extends SPAN by enabling remote monitoring of multiple switches across your network. The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating switches (therefore answer B is correct). The SPAN traffic from the sources is copied onto the RSPAN VLAN through a reflector port and then forwarded over trunk ports that are carrying the RSPAN VLAN to any RSPAN destination session monitoring the RSPAN VLAN.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_11_yj4/configuration/guide/lrescg/swspan.html

Question 5

Question 6

Explanation

When you monitor a trunk port as a source port, all VLANs active on the trunk are monitored by default. You can use VLAN filtering in order to limit SPAN traffic monitoring on trunk source ports to specific VLANs.

Reference: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html

Question 7

Explanation

SPAN sessions can monitor these traffic types:
+ Receive (Rx) SPAN—The goal of receive (or ingress) SPAN is to monitor as much as possible all the packets received by the source interface or VLAN before any modification or processing is performed by the switch. A copy of each packet received by the source is sent to the destination port for that SPAN session.

Packets that are modified because of routing or quality of service (QoS) – for example, modified Differentiated Services Code Point (DSCP) – are copied before modification -> Answer F is correct.
+ Transmit (Tx) SPAN—The goal of transmit (or egress) SPAN is to monitor as much as possible all the packets sent by the source interface after all modification and processing is performed by the switch. A copy of each packet sent by the source is sent to the destination port for that SPAN session. The copy is provided after the packet is modified.

Packets that are modified because of routing – for example, with modified time-to-live (TTL), MAC-address, or QoS values – are duplicated (with the modifications) at the destination port -> Answer C is not correct.

The default configuration for local SPAN session ports is to send all packets untagged ( -> Answer B is correct). SPAN also does not normally monitor bridge protocol data unit (BPDU) packets and Layer 2 protocols, such as Cisco Discovery Protocol (CDP), VLAN Trunk Protocol (VTP), Dynamic Trunking Protocol (DTP), Spanning Tree Protocol (STP), and Port Aggregation Protocol (PAgP)

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750e_3560e/software/release/15-0_1_se/configuration/guide/scg3750e/swspan.pdf

Question 8

Question 9

Question 10

Explanation

The reflector port is the mechanism that copies packets onto an RSPAN VLAN. The reflector port forwards only the traffic from the RSPAN source session with which it is affiliated. Any device connected to a port set as a reflector port loses connectivity until the RSPAN source session is disabled.