Display Filter Reference: Encapsulated Remote Switch Packet ANalysis

Protocol field name: erspan

Versions: 1.0.0 to 2.6.3

Back to Display Filter Reference

Field name Description Type Versions
erspan.bso Bad/Short/Oversized Unsigned integer, 2 bytes 2.2.0 to 2.6.3
erspan.cos COS Unsigned integer, 2 bytes 2.6.0 to 2.6.3
erspan.direction Direction Boolean 1.0.0 to 2.0.16, 2.6.0 to 2.6.3
erspan.direction2 Direction Unsigned integer, 2 bytes 1.6.0 to 2.4.9
erspan.encap Encap Unsigned integer, 2 bytes 2.2.0 to 2.6.3
erspan.ft Frame Type Unsigned integer, 2 bytes 2.2.0 to 2.6.3
erspan.gra Timestamp granularity Unsigned integer, 2 bytes 2.2.0 to 2.6.3
erspan.hw Hardware ID Unsigned integer, 2 bytes 2.2.0 to 2.6.3
erspan.index Index Unsigned integer, 4 bytes 2.2.0 to 2.6.3
erspan.o Optional Sub headers Unsigned integer, 2 bytes 2.2.0 to 2.6.3
erspan.p Has Ethernet PDU Unsigned integer, 2 bytes 2.2.0 to 2.6.3
erspan.pid.rsvd Reserved Unsigned integer, 8 bytes 2.4.0 to 2.6.3
erspan.pid1.port_index Port ID/Index Unsigned integer, 4 bytes 2.4.0 to 2.6.3
erspan.pid1.rsvd1 Reserved Unsigned integer, 4 bytes 2.6.0 to 2.6.3
erspan.pid1.vsmid VSM Domain ID Unsigned integer, 2 bytes 2.4.0 to 2.6.3
erspan.pid3.port_index Port ID/Index Unsigned integer, 2 bytes 2.4.0 to 2.6.3
erspan.pid3.rsvd1 Reserved Unsigned integer, 4 bytes 2.6.0 to 2.6.3
erspan.pid3.timestamp Upper 32-bit Timestamp Unsigned integer, 4 bytes 2.4.0 to 2.6.3
erspan.pid4.rsvd1 Reserved Unsigned integer, 4 bytes 2.4.0 to 2.6.3
erspan.pid4.rsvd2 Reserved Unsigned integer, 4 bytes 2.4.0 to 2.6.3
erspan.pid4.rsvd3 Reserved Unsigned integer, 4 bytes 2.4.0 to 2.6.3
erspan.pid5.port_index Port ID/Index Unsigned integer, 2 bytes 2.4.0 to 2.6.3
erspan.pid5.switchid Switch ID Unsigned integer, 2 bytes 2.4.0 to 2.6.3
erspan.pid5.timestamp Timestamp (seconds) Unsigned integer, 4 bytes 2.4.0 to 2.6.3
erspan.pid7.rsvd1 Reserved Unsigned integer, 4 bytes 2.6.0 to 2.6.3
erspan.pid7.source_index Source Index Unsigned integer, 4 bytes 2.6.0 to 2.6.3
erspan.pid7.timestamp Upper 32-bit Timestamp Unsigned integer, 4 bytes 2.6.0 to 2.6.3
erspan.platid Platform ID Unsigned integer, 4 bytes 2.4.0 to 2.6.3
erspan.priority Priority Unsigned integer, 2 bytes 1.0.0 to 2.4.9
erspan.reserved Reserved Unsigned integer, 4 bytes 2.6.0 to 2.6.3
erspan.sgt Security Group Tag Unsigned integer, 2 bytes 2.2.0 to 2.6.3
erspan.spanid SpanID Unsigned integer, 2 bytes 1.0.0 to 2.6.3
erspan.timestamp Timestamp Unsigned integer, 4 bytes 1.6.0 to 2.6.3
erspan.truncated Truncated Unsigned integer, 2 bytes 1.6.0 to 2.6.3
erspan.unknown1 Unknown1 Unsigned integer, 2 bytes 1.0.0 to 1.4.15
erspan.unknown2 Unknown2 Unsigned integer, 2 bytes 1.0.0 to 2.0.16
erspan.unknown3 Unknown3 Unsigned integer, 2 bytes 1.0.0 to 2.0.16
erspan.unknown4 Unknown4 Sequence of bytes 1.0.0 to 2.0.16
erspan.unknown5 Unknown5 Unsigned integer, 2 bytes 1.6.0 to 2.0.16
erspan.unknown6 Unknown6 Sequence of bytes 1.6.0 to 2.0.16
erspan.unknown7 Unknown7 Sequence of bytes 1.6.0 to 2.0.16
erspan.version Version Unsigned integer, 2 bytes 1.6.0 to 2.6.3
erspan.version.unknown Unknown version, please report or test to use fake ERSPAN preference Label 1.12.0 to 2.6.3
erspan.vlan Vlan Unsigned integer, 2 bytes 1.0.0 to 2.6.3
Go Beyond with Riverbed Technology

Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products that fully integrate with Wireshark.

I have a lot of traffic...

ANSWER: SteelCentral™ Packet Analyzer PE
  • • Visually rich, powerful LAN analyzer
  • • Quickly access very large pcap files
  • • Professional, customizable reports
  • • Advanced triggers and alerts
Learn More

Buy Now

No, really, I have a LOT of traffic…

ANSWER: SteelCentral™ AppResponse 11
  • • Full stack analysis – from packets to pages
  • • Rich performance metrics & pre-defined insights for fast problem identification/resolution
  • • Modular, flexible solution for deeply-analyzing network & application performance
Learn More