Differences

This shows you the differences between two versions of the page.

--- hardware:erspan [2018/05/01 21:35] – [ERSPAN Use case 2 : Temporary monitoring] veera
+++ hardware:erspan [2018/05/01 21:38] (current) – [On MTU and packet sizes] veera
@@ Line 38: / Line 38: @@
 In ERSPAN, there is a concept of Source and Destination session. A //source session// specifies interfaces from which traffic is captured  and sent to an analyzers IP address. A //destination session// specifies the output port to which the decapsulated traffic is written out.  You dont have to configure a destination session.
-Here we only configure a //source ERSPAN session// to the IP address of the TrisulNSM Virtual Machine.  When  you do this, the network will just forward the GRE Encapsulated mirror traffic to the TrisulNSM VM.  Since Trisul already supports ERSPAN as a capture mechanism, you can use that to decode the traffic. Here is a sample config from the Cisco manual (( Cisco Guide :  [[https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/lanswitch/configuration/xe-3s/lanswitch-xe-3s-book/lnsw-conf-erspan.html#GUID-A135491D-5FC8-4DF8-BA68-0B825C41B01F|Configuring ERSPAN]]  ))
+Here we only configure a //source ERSPAN session// to the IP address ''10.0.0.21'' of the TrisulNSM Virtual Machine.  When  you do this, the network will just forward the GRE Encapsulated mirror traffic to the TrisulNSM VM.  Since Trisul already supports ERSPAN as a capture mechanism, you can use that to decode the traffic. Here is a sample config from the Cisco manual (( Cisco Guide :  [[https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/lanswitch/configuration/xe-3s/lanswitch-xe-3s-book/lnsw-conf-erspan.html#GUID-A135491D-5FC8-4DF8-BA68-0B825C41B01F|Configuring ERSPAN]]  ))
 <code cisco>
@@ Line 51: / Line 51: @@
 no shutdown
 </code>
+==== On MTU and packet sizes ====
+<note important>Make sure you increase the MTU of the ERSPAN session and the IP path to accommodate the extra 42 bytes of tunnel header </note>
-<note important>Note about MTU for ERSPAN </note>
+  - **mtu 1900**  -- ERSPAN adds about 42 bytes of extra header bytes by way of Ethernet/IP/GRE header. The default ERSPAN MTU is 1500 bytes, so when you mirror full length packets they can be truncated. Make sure you increase the MTU of the ERSPAN to 1700 or 1900 or even the maximum size of 9000 bytes.
-  - **mtu 1900**  -- ERSPAN adds about 48 bytes of extra header bytes by way of Ethernet/IP/GRE header. The default ERSPAN MTU is 1500 bytes, so when you mirror full length packets they can be truncated. Make sure you increase the MTU of the ERSPAN to 1700 or 1900 or even the maximum size of 9000 bytes.
   - You also need to set the MTU on any bridges you create on the VM infrastructure.
   - If you dont set the MTU to a higher numbers, then packets will be truncated as per the ERSPAN documentation. Some implementations may fragment the IP packets, which will they place a load on the NSM tool to reassemble the packets.