I am using rcdcap to decapsulate ERSPAN on a Linux host. I would like to be able to split ERSPAN session IDs out to different logical capture interfaces. My current ERSPAN session IDs are 10 and 20. Can someone help me out with a tcpdump filter that would allow me to filter by either of those IDs? Understand this is something in the form of 'ip[xx:y] = hexvalue', but couldn't figure it out on my own.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 15 '19 at 20:26

I've recently was looking for the same info, and now I'm applying this filter to capture exact session ID:

tshark -i enp2s0f1 -b filesize:200000 -b files:5 -w f5_span.pcap -f 'ether[45] & 0x0f = 2'

This will get session ID 2. Also want to notice, that it's for ERSPAN type II packets. You can use Wireshark to determine byte number responsible for ERSPAN ID.


Filter ether[45] & 0x0f will give you opportunity to match session ID's from 0 to 15. If you want to use ID's above 15 (max for ERSPAN Session ID is 1023), then you will need to modify it to look like this:

ether[44] & 0x03 = 3 && ether[45] & 0xff = 255 (in this example we're matching ID 1023)

In your case, for session ID 10:

ether[45] & 0xff = 10

for session ID 20:

ether[45] & 0xff = 20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.