Encapsulated Remote SPAN (ERSPAN)

Like RSPAN, ERSPAN has the ability to take source SPAN traffic from one remote switch and deliver it to a host that can analyse traffic.

ERSPAN differs from RSPAN in that ERSPAN uses Layer 3, RSPAN uses Layer 2.

The start of a ERSPAN is configured with the command:

monitor session 10 type erspan-source

This defines the session number and the fact it is a ERSPAN.

With the initial command inputted, it will enter into a sub-menu where the rest of the session can be configured

 description TSHOOT
 source interface GigabitEthernet1/1
 no shutdown
 destination
  ip address 192.168.1.50
  erspan-id 2
  origin ip address 192.168.10.1
 exit
 erspan ttl 30

To verify the ERSPAN command on the switch, type show monitor session erspan-source session