Erpm Behavior On A Typical Dell Networking Os; Decapsulation Of Erpm Packets At The Destination Ip/ Analyzer - Dell S3048-ON Configuration Manual

no ip address
tagged GigabitEthernet 1/1-3
mac access-group flow in
shutdown

ERPM Behavior on a typical Dell Networking OS

The Dell Networking OS is designed to support only the Encapsulation of the data received / transmitted at the specified source port (Port
A). An ERPM destination session / decapsulation of the ERPM packets at the destination Switch are not supported.
Figure 93. ERPM Behavior
As seen in the above figure, the packets received/transmitted on Port A will be encapsulated with an IP/GRE header plus a new L2 header
and sent to the destination ip address (Port D's ip address) on the sniffer. The Header that gets attached to the packet is 38 bytes long.
If the sniffer does not support IP interface, a destination switch will be needed to receive the encapsulated ERPM packet and locally mirror
the whole packet to the Sniffer or a Linux Server.
Decapsulation of ERPM packets at the Destination IP/
Analyzer
• In order to achieve the decapsulation of the original payload from the ERPM header. The below two methods are suggested :
a Using Network Analyzer
• Install any well-known Network Packet Analyzer tool which is open source and free to download.
• Start capture of ERPM packets on the Sniffer and save it to the trace file (for example : erpmwithheader.pcap).
612 Port Monitoring
<<<<<<<<<<<<<< Only ingress packets are supported for mirroring