ERSPAN Support for Linux

Explore ERSPAN (Encapsulated Remote Switch Port Analyzer) support for Linux in this informative conference talk from the Linux Plumbers Conference. Dive into the implementation of ERSPAN for IPv4 and IPv6 in the Linux kernel, including both transmission and reception capabilities. Learn about three ways to utilize the ERSPAN protocol: native tunnel support using iproute2, metadata-mode tunnels with eBPF, and Open vSwitch integration. Discover how ERSPAN extends port mirroring from Layer 2 to Layer 3, allowing mirrored traffic to be encapsulated and sent through IP networks with configurable metadata. Gain insights into packet examples, tunnel configurations, and the differences between native and metadata tunnels. Understand the structure of GRE and ERSPAN headers, as well as the ERSPAN index and Type 3 specifications.

Introduction
Port Mirroring
Linux ERSPAN
ERSPAN Use Cases
ERSPAN Packet Example
ERSPAN Tunnel Example
Linux Native vs Metadata Tunnels
GRE Header
ERSPAN Header
ERSPAN Index
ERSPAN Type 3
Linux Native Mode Tunnel
Conclusion