Encapsulated Remote SPAN (ERSPAN)

Like RSPAN, ERSPAN has the ability to take source SPAN traffic from one remote switch and deliver it to a host that can analyse traffic.

ERSPAN differs from RSPAN in that ERSPAN uses Layer 3, RSPAN uses Layer 2.

The start of a ERSPAN is configured with the command:

monitor session 10 type erspan-source

This defines the session number and the fact it is a ERSPAN.

With the initial command inputted, it will enter into a sub-menu where the rest of the session can be configured

 description TSHOOT
 source interface GigabitEthernet1/1
 no shutdown
  ip address
  erspan-id 2
  origin ip address
 erspan ttl 30

To verify the ERSPAN command on the switch, type show monitor session erspan-source session



, ,




Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.