ERSPAN Configuration on Cisco IOS XE

Hello Chris.

Yes, you are correct. @ReneMolenaar states that:

For the destination we have to specify:

  • Source IP address: has to match with the origin IP address of the source session.

It should read:

  • Source IP address, which is the same as the destination IP address of the corresponding source session

as stated in Cisco Documentaiton.

So, the Source IP address stated should be the IP address of the Wireshark PC as shown in the last line of Rene’s configuration:

I will let @ReneMolenaar know to update it.

As for the GRE tunnel, that exists only between the two routers, specifically, between the two Gi3 interfaces. Note that packets captured by the Wireshark PC do not include any of the GRE headers as these are stripped before being passed on.

I hope this has been helpful!

Laz