Administrator Guide
– The Header that gets attached to the packet is 38 bytes long. In case of a packet with L3 VLAN, it would be 42 bytes
long. The original payload /original mirrored data starts from the 39
th
byte in a given ERPM packet. The rst 38/42
bytes of the header needs to be ignored/ chopped o.
– Some tools support options to edit the capture le. We can make use of such features (for example: editcap ) and chop
the ERPM header part and save it to a new trace le. This new le (i.e. the original mirrored packet) can be converted
back into stream and fed to any egress interface.
b. Using Python script
– Either have a Linux server's ethernet port ip as the ERPM destination ip or connect the ingress interface of the server
to the ERPM MirrorToPort. The analyzer should listen in the forward/egress interface. If there is only one interface, one
can choose the ingress and forward interface to be same and listen in the tx direction of the interface.
– Download/ Write a small script (for example: erpm.py) such that it will strip the given ERPM packet starting from the
bit where GRE header ends. Basically all the bits after 0x88BE need to be removed from the packet and sent out
through another interface.
– This script erpm.zip is available for download at the following location: http://en.community.dell.com/techcenter/
networking/m/force10_networking_scripts/20438882.aspx
– Unzip the erpm.zip and copy the erpm.py le to the Linux server.
– Run the python script using the following command:
python erpm.py -i <ingress interface> -o <egress interface>
erpm.py : This is the script downloaded from the script store.
<Ingress interface> : Specify the interface id which is connected to the mirroring port or this should be interface whose ip address
has been specied as the destination ip address in the ERPM session.
<Egress interface> : Specify another interface on the Linux server via which the decapsulation packets can Egress. In case there is
only one interface, the ingress interface itself can be specied as Egress and the analyzer can listen in the tx direction.
604
Port Monitoring