06:01:40.969924 IP 10.132.63.1 > localhost.localdomain: GREv0, seq 832271090, length 242: gre-proto-0x22eb 06:01:40.970929 IP 10.132.63.1 > localhost.localdomain: GREv0, seq 898777497, length 242: gre-proto-0x22eb 06:01:40.980932 IP 10.132.63.1 > localhost.localdomain: GREv0, seq 898777498, length 242: gre-proto-0x22eb 06:01:40.982913 IP 10.132.63.1 > localhost.localdomain: GREv0, seq 832271091, length 242: gre-proto-0x22eb 06:01:40.984911 IP 10.132.63.1 > localhost.localdomain: GREv0, seq 898777499,...
The problem is, that I'm still getting gre encapsulated dump and I think it's caused by erspan version header type 0x22eb. ERSPAN v1 header type is 0x88be My dump from RCDCap: (tos 0x28, ttl 25, id 64066, offset 0, flags [none], proto GRE (47), length 262) 10.132.63.1 > localhost.localdomain: GREv0, Flags [sequence# present], seq 832122434, length 242 gre-proto-0x22eb rcdcap -i ens33 --erspan --tap-persist --tap-device mon1 --expression "host 10.132.1.241"
Hi all, is there any way how to change RCDCap configuration for decapsulating erspan version 3 ???? Thanks.