Like RSPAN, ERSPAN has the ability to take source SPAN traffic from one remote switch and deliver it to a host that can analyse traffic.
ERSPAN differs from RSPAN in that ERSPAN uses Layer 3, RSPAN uses Layer 2.
The start of a ERSPAN is configured with the command:
monitor session 10 type erspan-source
This defines the session number and the fact it is a ERSPAN.
With the initial command inputted, it will enter into a sub-menu where the rest of the session can be configured
description TSHOOT source interface GigabitEthernet1/1 no shutdown destination ip address 192.168.1.50 erspan-id 2 origin ip address 192.168.10.1 exit erspan ttl 30
To verify the ERSPAN command on the switch, type
show monitor session erspan-source session