ERSPAN Configuration Example (Encapsulated Remote SPAN) [EVE-ng]
ERSPAN Topology
ERSPAN Configuration
R1 Configuration
interface GigabitEthernet2
ip address 192.168.10.254 255.255.255.0
negotiation auto
no mop enabled
no mop sysid
!
interface GigabitEthernet3
ip address 10.10.1.1 255.255.255.252
negotiation auto
no mop enabled
no mop sysid
!
monitor session 10 type erspan-source
description ## ERSPAN LearnDuty.com ##
source interface Gi2
destination
erspan-id 100
mtu 1464
ip address 10.10.1.2
origin ip address 10.10.1.1
R2 Configuration
interface GigabitEthernet2
ip address 172.31.1.254 255.255.255.0
negotiation auto
no mop enabled
no mop sysid
!
interface GigabitEthernet3
ip address 10.10.1.2 255.255.255.252
negotiation auto
no mop enabled
no mop sysid
!
monitor session 5 type erspan-destination
destination interface Gi2
source
erspan-id 100
ip address 10.10.1.2
ERSPAN Verification
On R1:
R1#show monitor session all
Session 10
----------
Type : ERSPAN Source Session
Status : Admin Enabled
Description : ## ERSPAN LearnDuty.com ##
Source Ports :
Both : Gi2
Destination IP Address : 10.10.1.2
MTU : 1464
Destination ERSPAN ID : 100
Origin IP Address : 10.10.1.1
On R2:
R2#show monitor session all
Session 5
---------
Type : ERSPAN Destination Session
Status : Admin Enabled
Destination Ports : Gi2
Source IP Address : 10.10.1.2
Source ERSPAN ID : 100
ERSPAN Wireshark capture
We will start a ping from Web-server (192.168.10.1) to interface Gi2 (192.168.10.254) on Router R1, and we will check 2 Wireshark capture:
- Wireshark Capture 1: on layer 3 link between R1 and R2 (GRE ERSPAN).
- Wireshark Capture 2: on the interface eth0 on the sniffer side to confirm that ERSPAN is working properly.
Wireshark Capture 1 (interface Gi3 R1 or R2):
Wireshark Capture 2 (interface Eth0 on the Sniffer):
