ERSPAN Tap port on decoder from multiple ESX Hosts
We are installing the All-In-One Netwitness virtual appliance suite and I'd like the Decoder to be able to be vmotioned to/from any one of three ESX 5.5 hosts. The span port will be a L3 Mirror port created on our VDS (Virtual Distributed Switch) and this basically encapsulates all mirror/span traffic from selected VMWare guests into GRE packets which are routed to our Decoder (Not a high volume TAP environment). This allows the Decoder to be Vmotioned from Host to Host however at the moment the traffic arrives encapsulated in GRE. What would be the best way to remove the GRE headers on the Decoder before the traffic actually enters the Decoder for processing?
- Community Thread
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform
I know this is an old question but it came up when I searched for ERSPAN. I'm hoping a NetWitness 11.4 Decoder will process the data inside a GRE tunnel. Can anyone confirm or deny this feature?
Thanks! With the help of support I have also found the VlanGRE parser that is used to decapsulate the GRE traffic. My only question now is if this parser supports the GRE protocol types from RFC1701 only or if the ERSPAN protocol types 0x88BE and 0x22EB are also supported. See https://tools.ietf.org/html/rfc1701 and https://tools.ietf.org/html/draft-foschiano-erspan-03