Users Guide

Table Of Contents
660 Monitoring Switch Traffic
Encapsulated Remote Port Analyzer
The Encapsulated Remote Port Analyzer (ERSPAN) allows mirroring
collection points to be located anywhere across a routed network. This is
achieved by encapsulating L2 mirrored packets using GRE with IP delivery.
After a packet has been encapsulated, it can be forwarded throughout the
L3-routed network.
ERSPAN uses a GRE tunnel to carry traffic between switches. ERSPAN
consists of an ERSPAN source session, an ERSPAN destination session, and
routable ERSPAN GRE-encapsulated traffic.
All participating switches must be connected at Layer 3 and the network path
must support the size of the ERSPAN traffic for egress mirroring session.
Dell platforms do not terminate the ERSPAN mirrored packets, that is, the
IP/GRE tunnel added on top of the mirrored packet is not removed. The
probe port of an ERSPAN destination session should be connected to a sniffer
PC running Wireshark. The capture filter needs to be configured in the
Wireshark application, to filter the packets with the IP protocol number 47,
which is GRE.
At the source switch, the following parameters are configured:
Source ports (that is, the traffic on this port is mirrored)
ERSPAN destination IPv4 address
ERSPAN origin IPv4 address
ERSPAN session ID
Tx/Rx
IP/MAC ACLs (optional)
IP/MAC ACLs can be configured with rate limit
At the destination switch, the following parameters are configured:
ERSPAN destination IPv4 address (as source)
ERSPAN session ID
Probe port
The following are limitations:
Only IPv4 is supported as an ERSPAN delivery method; IPv6 is not
supported due to a hardware limitation.