ERSPAN session ID?


I’m working with IXIA to receive ERSPAN traffic. Does anyone know what this session ID is?


The ERSPAN session ID is typically used to denote which monitor session the associated ERSPAN packet is associated on the source switch, since it is possible to configure two ERSPAN sessions between the same source and destination switches. Traditional ERSPAN receivers, such as a Cisco 7K, will drop the ERSPAN packet if it does not have an active ERSPAN destination configured with a matching session ID.

However, ExtraHop ignores the session ID on the ERSPAN packet and instead processes ALL ERSPAN frames it receives. Therefore, you should be able to specify any arbitrary value for the session ID on the ERSPAN source as long as ExtraHop is the configured destination IP and configured to terminate ERSPAN in the Network, Connectivity settings of the Admin UI.