Jawad Rajput

it worked, thanks a lot.

Thank you very much. I will try and let you know how it goes, I just want to confirm that I am replacing erspan-processor.cc and then recomplie rpm for CentOS-7, right? Or can I just replace erspan-processor.cc on already installed system?

Hello RCDCap Team, I have a question about decapsulating headers based on custom size. For Example, in our environment the ERSPAN header size is 38 bytes instead of 50 bytes, I have confirmed that using editcap utility on CentOS-7, when I take off 38 bytes off I can see actual SPAN traffic instead of GRE tunnel traffic. When I use RCDCap to decapsulate it takes some extra bytes of and loose Ether and IP headers. Is there a way to hardcore static length, e.g. 38 bytes, to decapsulate ERSPAN with RCDCap?...

Custom Header Size to Decapsulate