SPAN Configuration for Traffic Baseline on Cisco Switch

Why the Answer Is Correct

Correct answer: D — Configure SPAN (Switched Port Analyzer) to mirror the web traffic from Client-SiteA to the monitoring server. The requirement is to capture and analyze traffic to establish a baseline. SPAN is the native Cisco IOS feature designed specifically for copying network traffic from source ports or VLANs to a destination port where an analyzer (the monitoring server) is connected. Since the client site and the monitoring server are likely on the same switch infrastructure (as implied by the single-switch context of typical baselining questions), SPAN is the most direct and appropriate solution.

Why the Other Options Are Wrong

Option A (ERSPAN) is used when the source and destination are in different Layer 2 domains or require encapsulation in GRE packets; it is unnecessary complexity for a local baseline. Option B (RSPAN) is used for remote spanning across multiple switches, which is not indicated here. Option C (WCCP) is used to dynamically redirect traffic to a service engine (like a WSA) for inspection/filtering. While the ultimate goal might be to deploy the WSA, the current step is purely observational ('build a baseline'), making WCCP incorrect as it would actively divert traffic rather than just monitor it.

Community Comment Notes

Community consensus strongly supports SPAN. One user noted, "Monitoring on the same switch SPAN is correct," emphasizing the local nature of the task. Another user questioned why WCCP wasn't the answer, reflecting the common confusion between redirection and monitoring, but ultimately agreed with SPAN for general baselining purposes. The comments highlight that SPAN is the generic tool for visibility, whereas WCCP is for active service integration.