Display Filter Reference: Encapsulated Remote Switch Packet ANalysis
Protocol field name: erspan
Versions: 1.0.0 to 2.6.1
Back to Display Filter Reference
| Field name | Description | Type | Versions |
|---|---|---|---|
| erspan.bso | Bad/Short/Oversized | Unsigned integer, 2 bytes | 2.2.0 to 2.6.1 |
| erspan.cos | COS | Unsigned integer, 2 bytes | 2.6.0 to 2.6.1 |
| erspan.direction | Direction | Boolean | 1.0.0 to 2.0.16, 2.6.0 to 2.6.1 |
| erspan.direction2 | Direction | Unsigned integer, 2 bytes | 1.6.0 to 2.4.7 |
| erspan.encap | Encap | Unsigned integer, 2 bytes | 2.2.0 to 2.6.1 |
| erspan.ft | Frame Type | Unsigned integer, 2 bytes | 2.2.0 to 2.6.1 |
| erspan.gra | Timestamp granularity | Unsigned integer, 2 bytes | 2.2.0 to 2.6.1 |
| erspan.hw | Hardware ID | Unsigned integer, 2 bytes | 2.2.0 to 2.6.1 |
| erspan.index | Index | Unsigned integer, 4 bytes | 2.2.0 to 2.6.1 |
| erspan.o | Optional Sub headers | Unsigned integer, 2 bytes | 2.2.0 to 2.6.1 |
| erspan.p | Has Ethernet PDU | Unsigned integer, 2 bytes | 2.2.0 to 2.6.1 |
| erspan.pid.rsvd | Reserved | Unsigned integer, 8 bytes | 2.4.0 to 2.6.1 |
| erspan.pid1.port_index | Port ID/Index | Unsigned integer, 4 bytes | 2.4.0 to 2.6.1 |
| erspan.pid1.rsvd1 | Reserved | Unsigned integer, 4 bytes | 2.6.0 to 2.6.1 |
| erspan.pid1.vsmid | VSM Domain ID | Unsigned integer, 2 bytes | 2.4.0 to 2.6.1 |
| erspan.pid3.port_index | Port ID/Index | Unsigned integer, 2 bytes | 2.4.0 to 2.6.1 |
| erspan.pid3.rsvd1 | Reserved | Unsigned integer, 4 bytes | 2.6.0 to 2.6.1 |
| erspan.pid3.timestamp | Upper 32-bit Timestamp | Unsigned integer, 4 bytes | 2.4.0 to 2.6.1 |
| erspan.pid4.rsvd1 | Reserved | Unsigned integer, 4 bytes | 2.4.0 to 2.6.1 |
| erspan.pid4.rsvd2 | Reserved | Unsigned integer, 4 bytes | 2.4.0 to 2.6.1 |
| erspan.pid4.rsvd3 | Reserved | Unsigned integer, 4 bytes | 2.4.0 to 2.6.1 |
| erspan.pid5.port_index | Port ID/Index | Unsigned integer, 2 bytes | 2.4.0 to 2.6.1 |
| erspan.pid5.switchid | Switch ID | Unsigned integer, 2 bytes | 2.4.0 to 2.6.1 |
| erspan.pid5.timestamp | Timestamp (seconds) | Unsigned integer, 4 bytes | 2.4.0 to 2.6.1 |
| erspan.pid7.rsvd1 | Reserved | Unsigned integer, 4 bytes | 2.6.0 to 2.6.1 |
| erspan.pid7.source_index | Source Index | Unsigned integer, 4 bytes | 2.6.0 to 2.6.1 |
| erspan.pid7.timestamp | Upper 32-bit Timestamp | Unsigned integer, 4 bytes | 2.6.0 to 2.6.1 |
| erspan.platid | Platform ID | Unsigned integer, 4 bytes | 2.4.0 to 2.6.1 |
| erspan.priority | Priority | Unsigned integer, 2 bytes | 1.0.0 to 2.4.7 |
| erspan.reserved | Reserved | Unsigned integer, 4 bytes | 2.6.0 to 2.6.1 |
| erspan.sgt | Security Group Tag | Unsigned integer, 2 bytes | 2.2.0 to 2.6.1 |
| erspan.spanid | SpanID | Unsigned integer, 2 bytes | 1.0.0 to 2.6.1 |
| erspan.timestamp | Timestamp | Unsigned integer, 4 bytes | 1.6.0 to 2.6.1 |
| erspan.truncated | Truncated | Unsigned integer, 2 bytes | 1.6.0 to 2.6.1 |
| erspan.unknown1 | Unknown1 | Unsigned integer, 2 bytes | 1.0.0 to 1.4.15 |
| erspan.unknown2 | Unknown2 | Unsigned integer, 2 bytes | 1.0.0 to 2.0.16 |
| erspan.unknown3 | Unknown3 | Unsigned integer, 2 bytes | 1.0.0 to 2.0.16 |
| erspan.unknown4 | Unknown4 | Sequence of bytes | 1.0.0 to 2.0.16 |
| erspan.unknown5 | Unknown5 | Unsigned integer, 2 bytes | 1.6.0 to 2.0.16 |
| erspan.unknown6 | Unknown6 | Sequence of bytes | 1.6.0 to 2.0.16 |
| erspan.unknown7 | Unknown7 | Sequence of bytes | 1.6.0 to 2.0.16 |
| erspan.version | Version | Unsigned integer, 2 bytes | 1.6.0 to 2.6.1 |
| erspan.version.unknown | Unknown version, please report or test to use fake ERSPAN preference | Label | 1.12.0 to 2.6.1 |
| erspan.vlan | Vlan | Unsigned integer, 2 bytes | 1.0.0 to 2.6.1 |
Go Beyond with Riverbed Technology
I have a lot of traffic...
ANSWER: SteelCentral™ Packet Analyzer PE
- • Visually rich, powerful LAN analyzer
- • Quickly access very large pcap files
- • Professional, customizable reports
- • Advanced triggers and alerts
No, really, I have a LOT of traffic…
ANSWER: SteelCentral™ NetShark appliance
- • Troubleshoot problems faster
- • Quickly identify the applications running on your network
- • Monitor your virtual machine traffic