Tcpdump filter for ERSPAN session ID value

tcpdump

I am using rcdcap to decapsulate ERSPAN on a Linux host. I would like to be able to split ERSPAN session IDs out to different logical capture interfaces. My current ERSPAN session IDs are 10 and 20. Can someone help me out with a tcpdump filter that would allow me to filter by either of those IDs? Understand this is something in the form of 'ip[xx:y] = hexvalue', but couldn't figure it out on my own.

Best Answer

I've recently was looking for the same info, and now I'm applying this filter to capture exact session ID:

tshark -i enp2s0f1 -b filesize:200000 -b files:5 -w f5_span.pcap -f 'ether[45] & 0x0f = 2'

This will get session ID 2. Also want to notice, that it's for ERSPAN type II packets. You can use Wireshark to determine byte number responsible for ERSPAN ID.

Remark:

Filter ether[45] & 0x0f will give you opportunity to match session ID's from 0 to 15. If you want to use ID's above 15 (max for ERSPAN Session ID is 1023), then you will need to modify it to look like this:

ether[44] & 0x03 = 3 && ether[45] & 0xff = 255 (in this example we're matching ID 1023)

In your case, for session ID 10:

ether[45] & 0xff = 10

for session ID 20:

ether[45] & 0xff = 20

Related Topic