After updating our 6500 switches with SUP2T supervisors and with some Nexus switches on the way, I decided to play around with ERSPAN. Being able to capture traffic from a remote data centre directly to my workstation is very useful so I took the opportunity to update Dice to correctly format ERSPAN packets.
When the ERSPAN capture is sent directly to the host running the packet capture software, the captured data is encapsulated within GRE and an ERSPAN header as above. I thought it would be useful to be able to extract the original frames from the capture so added this option as well. When you save a capture you can now request that ERSPAN captures are extracted. For example, the frame above becomes:
