Trisul Network Analytics
Developer Zone

User Tools

Site Tools

You are here: Home » hardware » Configuring ERSPAN packet capture for Network Security Monitoring
Trace: • Scan Slices • what it does • How to push an alert into Trisul dispatcher from bash
hardware:erspan

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
hardware:erspan [2018/05/01 21:37] – [On MTU and packet sizes] veerahardware:erspan [2018/05/01 21:38] (current) – [On MTU and packet sizes] veera
Line 55: Line 55:
    
  
-<note important>Make sure you increase the MTU of the path to accommodate the extra 42 bytes of tunnel header </note>+<note important>Make sure you increase the MTU of the ERSPAN session and the IP path to accommodate the extra 42 bytes of tunnel header </note>
  
   - **mtu 1900**  -- ERSPAN adds about 42 bytes of extra header bytes by way of Ethernet/IP/GRE header. The default ERSPAN MTU is 1500 bytes, so when you mirror full length packets they can be truncated. Make sure you increase the MTU of the ERSPAN to 1700 or 1900 or even the maximum size of 9000 bytes.   - **mtu 1900**  -- ERSPAN adds about 42 bytes of extra header bytes by way of Ethernet/IP/GRE header. The default ERSPAN MTU is 1500 bytes, so when you mirror full length packets they can be truncated. Make sure you increase the MTU of the ERSPAN to 1700 or 1900 or even the maximum size of 9000 bytes.
hardware/erspan.1525190873.txt.gz · Last modified: 2018/05/01 21:37 by veera