Jawad Rajput - 2019-01-24

Hello RCDCap Team,

I have a question about decapsulating headers based on custom size. For Example, in our environment the ERSPAN header size is 38 bytes instead of 50 bytes, I have confirmed that using editcap utility on CentOS-7, when I take off 38 bytes off I can see actual SPAN traffic instead of GRE tunnel traffic. When I use RCDCap to decapsulate it takes some extra bytes of and loose Ether and IP headers. Is there a way to hardcore static length, e.g. 38 bytes, to decapsulate ERSPAN with RCDCap? Unfortunately, I cannot share PCAP due to organization policy. Please advise.