[c-nsp] Bug ID CSCdy72539 For GRE Tunneling on 6500 PFC3B

[Phil Mayers]

Saku Ytti wrote:
> On (2006-12-08 11:07 -0800), Sukumar Subburayan wrote:
> 
>> Just an FYI, based on popular customer demand/request for 
>> troubleshooting instrumentation, we are targetting this CPU
>> capture feature for an upcoming release for the Cat65xx, so that, it is 
>> more user friendly, extensible and customizable.
>>
>> It will be able to capture traffic bound to RP/SP CPU and  store 
>> as files in capture formats, in local flash devices, which  then  can be 
>> shipped to Cisco TAC for further analysis or be opened with sniffer 
>> utilities like Ethereal.
> 
> Another small FYI, Phil's script is great, if you're planning
> to do debugging (it reads the packets straight out from socket
> and writes to pcap). But if you've already captured data
> from GRE tunnel interface via libpcap, you don't have
> very useful file, unless you pop out linux_cooked_capture
> and erspan headers before each file, change pcap
> header for each file to fix size and change linktype
> from linux_cooked_capture to ethernet.
> Being in above situation I wrote this morning small script to
> do just that, let me know if it would be useful to you and I'll
> share it.
> 
> Thanks,

For those who are interested, I've put my script (which does a similar 
thing you mention i.e. decodes the erspan headers and writes 
appropriately formatteed pcap ones) on Cluepon:

http://cisco.cluepon.net/index.php/ERSPAN_to_PCAP_script

Apologies for the nasty encoding hack. If someone more MediaWiki-savvy 
knows how to put the script as a downloadable text file, feel free.

Script is GPL, version 2 only, copyright me. Patches welcomed.