I hate to answer my own question, but the problem was the MTU on the outbound interface. It was set to 1500 and GRE enscapsulation would result in packets that need to be fragged. The docs say the "do not frag" bit is set in ERSPAN packets. Is the CPU hit taken because of generation of an ICMP message? mb