This section describes the ERSPAN installation for the Allegro Network Multimeter to receive ERSPAN packets. ERSPAN is the abbreviation for Encapsulated Remote Switch Port Analyzer. It is a Switch feature that encapsulates traffic into an IP/GRE tunnel.
What is the ERSPAN mode?
ERSPAN is an advanced Switch feature that encapsulates mirrored traffic into an IP and GRE packet. The full method is described in the RFC draft https://tools.ietf.org/html/draft-foschiano-erspan-03.
The advantage of the ERSPAN mode is that it can be routed via IP and the ERSPAN generator can be at a different location than the Allegro Network Multimeter. This allows very simple captures of a low-bandwidth remote device.
How should the ERSPAN mode be used?
ERSPAN quality depends on the Switch performance and the bandwidth and latency between the Switch and the Allegro Network Multimeter. It will also add substantial load to the IP networks and can generate a packet storm when the ERSPAN packets are mirrored again into the ERSPAN tunnel.
See Limitations for more details.
How can I configure the ERSPAN mode?
Please refer to your Switch manual how to set up a Switch ERSPAN channel. Please note that the Allegro Network Multimeter can also send ERSPAN traffic.
You can enable the ERSPAN mode in parallel to the In-Line installation or Mirror Port, Tap and Packet Broker Installation for one or multiple interfaces. Please be aware that ERSPAN cannot work in parallel with the Bridge mode for such an interface. The Bridge mode will be disabled for this interface pair when ERSPAN is enabled for one interface.
The ERSPAN mode works on all of the Allegro Network Multimeter interfaces including the Virtual Edition.
Once the ERSPAN mode is activated, the interface will respond to ARP requests for the configured IP address. The ERSPAN interface responds to ICMP Ping messages. Once ERSPAN is configured, you should be able to send a ping to the IP address.
Behaviour of the ERSPAN mode
The behaviour for all packets on the ERSPAN interfaces is:
- reply to ARP requests
- reply to Ping messages
- decapsulate all ERSPAN packets and forward them to the packet analytics
- discard all other packets
Be aware that mirrored packets without an ERSPAN header are dropped.
The ERSPAN header will be decapsulated for the analytics. The Allegro Network Multimeter analyzes the inner packet and ignores the outer ERSPAN header. The Packet Ring Buffer and Pcap export stores the full packets including the ERSPAN header.
Configuration of an Allegro as an ERSPAN sender
The Allegro Network Multimeter allows you to send ERSPAN packets via the management interface over a switched and routed network like a pcap capture. Allegro recommend you use the ERSPAN sending feature only via the LAN interface and not with the Wi-Fi interface. Please see [#Limitations] for more details. Please make sure that the sending Allegro MTU size is big enough to send the whole packet including the ERSPAN header. To configure the Allegro Network Multimeter as an ERSPAN sender, increase the MTU size on the management interface AND on all Switches between the sending and receiving Allegro Network Multimeter. This can be done at Settings → Management settings → LAN management interface.
Once this is configured, you can initiate a live capture with or without filters with the capture button. Please select the ERSPAN as the capture type and fill the receiving IP address.
This can be done also using Back-In-Time. Please use the real-time replay with factor 1.0 to replay with the same packet timing for the receiving Allegro Network Multimeter. See Limitations for more details.
ERSPAN protocol version
The Allegro Network Multimeter supports ERSPAN version II and III as described in the RFC draft https://tools.ietf.org/html/draft-foschiano-erspan-03.
ERSPAN is supported for non-fragmented ERSPAN packets. Please make sure that the link between the Switch and the Allegro Network Multimeter supports a higher MTU than the monitored link. We recommend to use jumbo frames with 9000 bytes to forward packets.
The Allegro Network Multimeter does NOT use the timestamp of the ERSPAN receiver since there is only one real-time source for the Allegro Network Multimeter.
Please note that the Back-In-Time support requires that the storage is fast enough to extract the packets at the configured speed. A replay with factor 1.0 should work as most Ring Buffers can read at the same speed as they write data. Please stop or pause the Ring Buffer in this case to allow high speed reads. Higher factors work very well as long as the capture rate is lower than the replay rate. If the storage is not fast enough, the replay will slow down to the storage speed. If you use the Back-In-Time mode without any speed limitation, it will be limited by the storage and the interface link speed.