cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

ERSPAN support?

ole_eide
Newcomer

There are some rumors that you are looking at implementing ERSPAN support in the upcoming versions of DC-RUM. Is this true? If so, could you please provide an estimate of when it will be available? In my context ERSPAN support meaning stripping the 50 bytes being the "cisco erspan gre header".



Thanks,

Ole

2 REPLIES 2

mazen_mheish22
Inactive

Hi Ole,



I checked with some folks here on the architecture and support side and we are not aware of any plans to support ERSPAN at the moment. I can see that you opened a support case for that as well and it seems that we are working with Development to provide you with a precise answer. I hope we'll be able to answer your question soon.



Thanks,



Mazen

Ole

We found one solution that helped us to work with Cisco ERSPAN traffic

It is additional module named - RCPCAP. RCDCAP is wrapper program that dissects the traffic and creates a virtual interface where the traffic is already decapsulated.

http://brezular.com/2015/05/03/decapsulation-erspan-traffic-with-open-source-tools/#comment-10263

We tested this solution and it worked for Cisco ERSPAN

But it works only for ERSPAN

If you have GRE tunnel from VMware example than it will not work

Because VMware does not use ERSPAN. it use only GRE tunnel

So we are also very much expect from DC RUM developers when they implement the ability to analyze traffic from GRE on AMD