CCNP ENCOR reference
SPAN, RSPAN & ERSPAN Quick Reference
Traffic mirroring scope and the right tool for the job — tested in ENCOR objective 4.4.
Pick the right one
SPAN: source and destination on the SAME switch. Simplest, most widely available, strictly local.
RSPAN: extends mirroring across multiple switches within the same Layer 2 domain, using a dedicated RSPAN VLAN that floods across trunks like any other VLAN — cannot cross a Layer 3 (routed) boundary.
ERSPAN: encapsulates mirrored traffic in GRE, letting it be routed anywhere reachable via IP — the only one of the three that crosses a Layer 3 boundary. Requires ERSPAN-capable hardware and adds encapsulation overhead.
Common mistakes
Assuming SPAN reaches a device on a different switch — it doesn't; that's what RSPAN is for.
An RSPAN VLAN must be trunked consistently across every switch in the path — one missing trunk allowance breaks the whole path.
A monitor session's destination port can be silently reassigned by an unrelated later configuration change — always re-verify with 'show monitor session' after any nearby config work.
Scope at a glance
| Scope | Crosses Layer 3? | |
|---|---|---|
| SPAN | Single switch | No |
| RSPAN | Multiple switches, same Layer 2 domain | No |
| ERSPAN | Anywhere reachable via IP routing | Yes |