A county wants to mirror traffic from closet access switches to a central analyzer in the data center closet, keeping the mirrored frames inside a Layer-2 campus fabric. Which SPAN-family approach is designed for that remote Layer-2 capture?
Select an answer to reveal the explanation.
Short Explanation
You can think of RSPAN as carrying mirrored frames in a dedicated VLAN across the Layer-2 campus to your analyzer. Local SPAN stays on its source switch, so RSPAN is the remote Layer-2 courier you need.
Full Explanation
The county needs mirrored traffic from closet access switches delivered to a central analyzer in the data-center closet while the frames remain inside a Layer-2 campus fabric. RSPAN is designed for this remote Layer-2 capture: a dedicated RSPAN VLAN carries mirrored frames from source switches to a remote switch where the analyzer attaches, without IP encapsulation across a routed hop. This fits a contiguous Layer-2 path from the closets to the data-center closet. Local SPAN fails because its destination port must be on the same switch as the source, so it cannot by itself deliver closet traffic to a remote analyzer. IP SLA UDP jitter with the analyzer as responder measures synthetic delay variation; it does not mirror production frames from access ports. NetFlow sampling of only TCP SYN packets is flow metering and export, not a SPAN-family mirror session, and SYN-only sampling does not provide the full-frame visibility the analyzer expects. Exam caveat: RSPAN requires a Layer-2 path for its VLAN; if the campus path is Layer-3 only, RSPAN will not work. The RSPAN VLAN should also be dedicated and pruned, since flooding mirrored traffic everywhere wastes bandwidth. For a practical check, create the dedicated RSPAN VLAN, configure source sessions on closet switches and a destination session on the analyzer switch, confirm the VLAN is trunked only where needed, and verify that the analyzer receives mirrored frames without saturating uplink capacity.