Is there a way to ENCAPSULATE traffic into an ERSPAN tunnel without using a cisco device? What if I wanted to source ERSPAN traffic from a Linux host instead of a switch?
2
-
Perhaps... sourceforge.net/projects/rcdcap– RickyAug 31, 2015 at 0:51
-
Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.– Ron Maupin ♦Aug 6, 2017 at 17:55
Add a comment
|
1 Answer
As far as I know, ERSPAN is a Cisco proprietary protocol. That's not to say that someone, somewhere hasn't created something similar or hasn't reverse engineered it. You could ask on the Linux forum.
answered Aug 30, 2015 at 16:53
-
Indeed it has been reverse engineered (wireshark will recognize it). Plus, Cisco actually published version 2 as an rfc (draft, now expired.) tools.ietf.org/html/draft-foschiano-erspan-00 HOWEVER, documented doesn't mean you can implement it in your "product" without being sued. (decoding the frame is one thing, encoding is another. that's why many things can understand CDP, but won't speak it.)– RickyAug 31, 2015 at 0:50