Encapsulated Remote SPAN or GRE Tunnel Sniffing on OCSM Probes (Doc ID 2191832.1)

Last updated on NOVEMBER 20, 2023

Applies to:

Goal

Question: Does OCOM support the sniffing of Encapsulated Remote SPAN (ERSPAN) or something similar? This is to understand if using direct connection of probes to mirrored port can be avoided and use ERSPAN and forward packets to the probe interfaces.

To explain the mentioned technology:

Local SPAN: Mirrors traffic from one or more interface on the switch to one or more interfaces on the same switch.

Remote SPAN (RSPAN): An extension of SPAN called remote SPAN or RSPAN. RSPAN allows you to monitor traffic from source ports distributed over multiple switches, which means that you can centralize your network capture devices. RSPAN works by mirroring the traffic from the source ports of an RSPAN session onto a VLAN that is dedicated for the RSPAN session. This VLAN is then trunked to other switches, allowing the RSPAN session traffic to be transported across multiple switches. On the switch that contains the destination port for the session, traffic from the RSPAN session VLAN is simply mirrored out the destination port.

Encapsulated remote SPAN (ERSPAN): encapsulated Remote SPAN (ERSPAN), as the name says, brings generic routing encapsulation (GRE) for all captured traffic and allows it to be extended across Layer 3 domains.
 

Solution

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.