ERSPAN on nexus 5K

[mazhar mahadik]

Hi guyz,

I have scenario where multiple 5Ks are connected to 6500 VSS as Core,

& we need to capture traffic from certain vlan across multiple 5Ks & send it to Capturing device connected to 3750 via VSS core.

(SRc VLAN) 5K-->6500(VSS)--->3750--> Capturing Device.

Since ERSPAN needs src device as nexus & destination as well a nexus device.

So is there any other alternative to acheive this.

Thanks.

[Steve Fuller · Accepted solution]

Hi Mazhar,

Depending upon your capture device, there is the option to send the ERSPAN traffic directly to that device. If the capture device has a routable IP address and understands the format of the ERSPAN encapsulation, then it can be configured as the destination of the ERSPAN traffic.

This is discussed in the forum post Nexus 5K and ERSPAN. In that example I was using the Nexus 5K as the ERSPAN source and a Redhat Linux server with tcpdump as my capture device.

Regards