ERSPAN Configuration on Cisco IOS XE

(Rene Molenaar) #1

This topic is to discuss the following lesson:

(Chris N) #2

You say for the destination you have to specify the source IP address, but I don’t see that anywhere in the config?

Also is the GRE tunnel between the wireshark server and R1, rather than R1 and R2?


(Lazaros Agapides) #3

Hello Chris.

Yes, you are correct. @ReneMolenaar states that:

For the destination we have to specify:

  • Source IP address: has to match with the origin IP address of the source session.

It should read:

  • Source IP address, which is the same as the destination IP address of the corresponding source session

as stated in Cisco Documentaiton.

So, the Source IP address stated should be the IP address of the Wireshark PC as shown in the last line of Rene’s configuration:

I will let @ReneMolenaar know to update it.

As for the GRE tunnel, that exists only between the two routers, specifically, between the two Gi3 interfaces. Note that packets captured by the Wireshark PC do not include any of the GRE headers as these are stripped before being passed on.

I hope this has been helpful!


(Micah C) #4

The Wireshark capture in the lesson shows the GRE encapsulation.

(Lazaros Agapides) #5

Hello Micah

Yes I stand corrected, the GRE header is included as the tunnel used by ERSPAN.



(Chris N) #6

There is also a slightly different way to configure the “sniffer” as a layer 2 device.

Many sniffers will not use a layer 3 IP address on the network to sniff traffic, they will have an IP for management, but layer 2 interfaces with no IP for capturing network traffic.

In this case you can configure the source and destination IP as a loopback on the remote router, and the destination interface as the layer 2 interface of the sniffer. In this case, the GRE header would surely be stripped on the router.

(Lukas E) #7

You can also combine RSPAN and ERSPAN. For example it’s possible to create a rspan vlan and then use this vlan as source for the ERSPAN session. Later you can cut off the GRE Header to get the original frame:

editcap -C 50 capture.pcap caputure_filtered.pcap

1 Like