ERSPAN and PPCAP on Rx 6100v

The customer is receiving traffic from the ERSPAN tunnel on EDA 6100v high-performance ERSPN interface. The customer attached a disk to enable EDA Pcap capability and what we notice is that the Packet tab still shows packets with ERSPAN header(GRE). because of this customer is unable to filter traffic and our drill down to packets does not work.

Is this bug or product limitation? or am I missing configuration

Hi, @bath.

Based on your description, we’d like to take a closer look as part of a case with ExtraHop Support. Could you open one?

Thanks.

When you enable PPCAP (precision PCAP) on an ECA or EDA, once you take a PPCAP, the “Packets” tab shows up in the UI and the bullseye shows up next to records.

This is for ALL parts of the UI.

PPCAP is a wonderful feature.

Having a bullseye displayed next to all records even there is no ETA in play is . . . sub-optimal.

Repro.

  1. Deploy EDA, EXA. NO ETA.

  2. Bask in the glory of wire data. Also observe no “Packets” in UI, no bullseye next to records.

  3. Also, browse to Records, note absence of bullseye.

  4. Write a trigger that calls Flow.captureStart. Capture few packets. Bask in the glow of precision packet capture.

  5. Reload UI. A wild Packets button appears at the top of the UI.

  6. Browse to records, bullseye next to every record.

@shaundavid support Case 200522-55907. Please let us know anything to follow up, thanks.