An emergency-management office must mirror a suspect access port to a packet broker. The broker sits across a Layer-3 boundary from the source switch. Which capture method applies?
Select an answer to reveal the explanation.
Short Explanation
Local SPAN is same-switch only; RSPAN rides a special VLAN across L2; ERSPAN wraps the mirror in GRE so it can cross routers. When your packet broker lives on the other side of L3, ERSPAN is the ticket.
Full Explanation
Emergency-management mirroring to a packet broker across a Layer-3 boundary requires ERSPAN so mirrored traffic is GRE-encapsulated and can traverse IP networks to the broker. Local SPAN cannot cross L3; ERSPAN exists for exactly that topology. When the broker is IP-reachable rather than in the same L2 domain, ERSPAN is the applicable capture method.
Local SPAN only is insufficient when the destination is remote across L3. RSPAN uses a remote VLAN constrained to L2 extension and is not simply “routed hop-by-hop as ordinary IP” without tunnels. Disabling mirroring and using debug ip packet detail on the supervisor is not a substitute for port mirroring to a broker and can devastate CPU.
Exam caveat: ERSPAN source and destination IPs, VRF, and TTL/filter ACLs must be correct; do not confuse RSPAN VLAN designs with ERSPAN GRE. Operational check: configure ERSPAN from the suspect access switch toward the broker IP, start a known test flow, and verify encapsulated mirrors arrive for analysis without spanning a fragile L2 path across the campus core. Emergency-management packet brokers should terminate ERSPAN in a controlled analysis VRF so mirrored civic traffic is not exposed on general user networks.