tcpdump filter for ERSPAN session ID value

Question

I am using rcdcap to decapsulate ERSPAN on a Linux host. I would like to be able to split ERSPAN session IDs out to different logical capture interfaces. My current ERSPAN session IDs are 10 and 20. Can someone help me out with a tcpdump filter that would allow me to filter by either of those IDs? Understand this is something in the form of 'ip[xx:y] = hexvalue', but couldn't figure it out on my own.

Answer 1

I've recently was looking for the same info, and now I'm applying this filter to capture exact session ID:

tshark -i enp2s0f1 -b filesize:200000 -b files:5 -w f5_span.pcap -f 'ether[45] & 0x0f = 2'

This will get session ID 2. Also want to notice, that it's for ERSPAN type II packets. You can use Wireshark to determine byte number responsible for ERSPAN ID.

Remark:

Filter ether[45] & 0x0f will give you opportunity to match session ID's from 0 to 15. If you want to use ID's above 15 (max for ERSPAN Session ID is 1023), then you will need to modify it to look like this:

ether[44] & 0x03 = 3 && ether[45] & 0xff = 255 (in this example we're matching ID 1023)

---

In your case, for session ID 10:

ether[45] & 0xff = 10

for session ID 20:

ether[45] & 0xff = 20

Answer 2

The ERSPAN session id is a 10bit field located in the 30-31st byte of the outer IP packet (ERSPAN is encapsulated inside a GRE tunnel), starting with the 2 least significant bit of the 30th byte.

Considering the whole frame, in case of Ethernet II L2 outer encapsulation, the field is located in the 44-45th byte (additional 14 bytes of the Ethernet header).

Therefore the corresponding filter should be:

'ip[30:2]&0x3FF'=*session-id*
or
'ether[44:2]&0x3FF'=*session-id*

Examples:

tcpdump proto gre and 'ip[30:2]&0x3FF'=1
# matches for erspan session id 1

tcpdump proto gre and 'ether[44:2]&0x3FF'=1001
# matches for erspan session id 1001