Official certification from the Wireshark Foundation is available! Learn about becoming a Wireshark Certified Analyst.

Display Filter Reference: Encapsulated Remote Switch Packet ANalysis

Protocol field name: erspan

Versions: 1.0.0 to 4.6.0

Back to Display Filter Reference

Field name Description Type Versions
erspan.bsoBad/Short/OversizedUnsigned integer (16 bits)2.2.0 to 4.6.0
erspan.cosCOSUnsigned integer (16 bits)2.6.0 to 4.6.0
erspan.directionDirectionBoolean1.0.0 to 2.0.16, 2.6.0 to 4.6.0
erspan.direction2DirectionUnsigned integer (16 bits)1.6.0 to 2.4.16
erspan.encapEncapUnsigned integer (16 bits)2.2.0 to 4.6.0
erspan.ftFrame TypeUnsigned integer (16 bits)2.2.0 to 4.6.0
erspan.graTimestamp granularityUnsigned integer (16 bits)2.2.0 to 4.6.0
erspan.hwHardware IDUnsigned integer (16 bits)2.2.0 to 4.6.0
erspan.indexIndexUnsigned integer (32 bits)2.2.0 to 4.6.0
erspan.oOptional Sub headersUnsigned integer (16 bits)2.2.0 to 4.6.0
erspan.pHas Ethernet PDUUnsigned integer (16 bits)2.2.0 to 4.6.0
erspan.pid.rsvdReservedUnsigned integer (64 bits)2.4.0 to 4.6.0
erspan.pid1.port_indexPort ID/IndexUnsigned integer (32 bits)2.4.0 to 4.6.0
erspan.pid1.rsvd1ReservedUnsigned integer (32 bits)2.6.0 to 4.6.0
erspan.pid1.vsmidVSM Domain IDUnsigned integer (32 bits)2.4.0 to 4.6.0
erspan.pid3.port_indexPort ID/IndexUnsigned integer (32 bits)2.4.0 to 4.6.0
erspan.pid3.rsvd1ReservedUnsigned integer (32 bits)2.6.0 to 4.6.0
erspan.pid3.timestampUpper 32-bit TimestampUnsigned integer (32 bits)2.4.0 to 4.6.0
erspan.pid4.rsvd1ReservedUnsigned integer (32 bits)2.4.0 to 4.6.0
erspan.pid4.rsvd2ReservedUnsigned integer (32 bits)2.4.0 to 4.6.0
erspan.pid4.rsvd3ReservedUnsigned integer (32 bits)2.4.0 to 4.6.0
erspan.pid5.port_indexPort ID/IndexUnsigned integer (32 bits)2.4.0 to 4.6.0
erspan.pid5.switchidSwitch IDUnsigned integer (32 bits)2.4.0 to 4.6.0
erspan.pid5.timestampTimestamp (seconds)Unsigned integer (32 bits)2.4.0 to 4.6.0
erspan.pid7.rsvd1ReservedUnsigned integer (32 bits)2.6.0 to 4.6.0
erspan.pid7.source_indexSource IndexUnsigned integer (32 bits)2.6.0 to 4.6.0
erspan.pid7.timestampUpper 32-bit TimestampUnsigned integer (32 bits)2.6.0 to 4.6.0
erspan.platidPlatform IDUnsigned integer (32 bits)2.4.0 to 4.6.0
erspan.priorityPriorityUnsigned integer (16 bits)1.0.0 to 2.4.16
erspan.reservedReservedUnsigned integer (32 bits)2.6.0 to 4.6.0
erspan.sgtSecurity Group TagUnsigned integer (16 bits)2.2.0 to 4.6.0
erspan.spanidSpanIDUnsigned integer (16 bits)1.0.0 to 4.6.0
erspan.timestampTimestampUnsigned integer (32 bits)1.6.0 to 4.6.0
erspan.truncatedTruncatedUnsigned integer (16 bits)1.6.0 to 4.6.0
erspan.unknown1Unknown1Unsigned integer (16 bits)1.0.0 to 1.4.15
erspan.unknown2Unknown2Unsigned integer (16 bits)1.0.0 to 2.0.16
erspan.unknown3Unknown3Unsigned integer (16 bits)1.0.0 to 2.0.16
erspan.unknown4Unknown4Byte sequence1.0.0 to 2.0.16
erspan.unknown5Unknown5Unsigned integer (16 bits)1.6.0 to 2.0.16
erspan.unknown6Unknown6Byte sequence1.6.0 to 2.0.16
erspan.unknown7Unknown7Byte sequence1.6.0 to 2.0.16
erspan.versionVersionUnsigned integer (16 bits)1.6.0 to 4.6.0
erspan.version.unknownUnknown version, please report or test to use fake ERSPAN preferenceLabel1.12.0 to 4.6.0
erspan.vlanVlanUnsigned integer (16 bits)1.0.0 to 4.6.0