[c-nsp] RSPAN over IP

[Joerg Mayer]

On Sun, Jul 08, 2007 at 07:08:36PM +0200, Simon Leinen wrote:
> Saku Ytti writes:
> > python version makes more sense, if you're starting
> > your debug session now. ruby version makes more
> > sense if you already are in possession of pcap
> > capture of ERSPAN and want to have something
> > useful to look at in eg. wireshark.
>
> Note that the brand-new Wireshark 0.99.6 claims to have ERSPAN
> decoding support built in:
>
> http://www.wireshark.org/lists/wireshark-announce/200707/msg00000.html

Urgs, that's not true. It has the code to do the decoding, but
unfortunately can't recognize the media type yet, as cisco in it's
wisdom reused an existing media type and didn't register their own :-(
That's something that's still missing. For all practical purposes
Wireshark doesn't support ERSPAN, until I implement some heuristic
to decide whether the packet is ERSPAN or what the media type says.

Ciao
       Joerg

--
Joerg Mayer                                           <jmayer at loplof.de>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.