hardware:erspan
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
hardware:erspan [2018/05/01 21:27] – [What is ERSPAN] veera | hardware:erspan [2018/05/01 21:37] – [Configuring] veera | ||
---|---|---|---|
Line 17: | Line 17: | ||
There are three port mirroring features in Cisco : | There are three port mirroring features in Cisco : | ||
- Physical SPAN -- this is the common port SPAN. It is supported on nearly all models of Cisco and allows you to physically mirror one or more ports to a //monitor port//. | - Physical SPAN -- this is the common port SPAN. It is supported on nearly all models of Cisco and allows you to physically mirror one or more ports to a //monitor port//. | ||
- | - RSPAN -- Remote SPAN, this is a Layer-2 port mirror where you can capture remote packets over a Layer2 VLAN and bring it across your network | + | - RSPAN -- Remote SPAN, this is a Layer-2 port mirror where you can capture remote packets over a Layer2 VLAN and bring it across your L2 network |
- | - ERSPAN -- Layer3 Remote SPAN, this is what we are talking about in this article. | + | - ERSPAN -- Layer3 Remote SPAN, this is what we are talking about in this article. |
==== ERSPAN Use case 1 : Virtual Machine ==== | ==== ERSPAN Use case 1 : Virtual Machine ==== | ||
Line 24: | Line 24: | ||
To provide network packets to Trisul Network Analytics or other NSM tool running inside a Virtual Machine. Particularly when the administrators of the VM are unable to provide a promiscuous mode physical interface. | To provide network packets to Trisul Network Analytics or other NSM tool running inside a Virtual Machine. Particularly when the administrators of the VM are unable to provide a promiscuous mode physical interface. | ||
+ | |||
+ | Recently, we had a customer who was consolidating all their server systems on a Nutanix VM farm. They wanted to put TrisulNSM also on a VM on that farm instead of a physical box. Since the Nutanix does not yet support a physical port mirror at the VM level (( Nutanix [[https:// | ||
==== ERSPAN Use case 2 : Temporary monitoring ==== | ==== ERSPAN Use case 2 : Temporary monitoring ==== | ||
- | When you want to temporarily monitor an interface without having to do any extra cabling that would be required for a physical layer SPAN. If you are already doing ERSPAN, then adding an extra port is trivial. | + | If you are already doing ERSPAN, then adding an extra port is trivial. |
Line 36: | Line 38: | ||
In ERSPAN, there is a concept of Source and Destination session. A //source session// specifies interfaces from which traffic is captured | In ERSPAN, there is a concept of Source and Destination session. A //source session// specifies interfaces from which traffic is captured | ||
- | Here we only configure a //source ERSPAN session// to the IP address of the TrisulNSM Virtual Machine. | + | Here we only configure a //source ERSPAN session// to the IP address |
<code cisco> | <code cisco> | ||
Line 50: | Line 52: | ||
</ | </ | ||
+ | ==== On MTU and packet sizes ==== | ||
+ | |||
<note important> | <note important> |
hardware/erspan.txt · Last modified: 2018/05/01 21:38 by veera