Deployment Guide

ERPM Behavior on a typical Dell EMC Networking OS
The Dell EMC Networking OS is designed to support only the Encapsulation of the data received / transmitted at the specified
source port (Port A). An ERPM destination session / decapsulation of the ERPM packets at the destination Switch are not
supported.
Figure 103. ERPM Behavior
As seen in the above figure, the packets received/transmitted on Port A will be encapsulated with an IP/GRE header plus a new
L2 header and sent to the destination ip address (Port D’s ip address) on the sniffer. The Header that gets attached to the
packet is 38 bytes long.
If the sniffer does not support IP interface, a destination switch will be needed to receive the encapsulated ERPM packet and
locally mirror the whole packet to the Sniffer or a Linux Server.
Decapsulation of ERPM packets at the Destination IP/ Analyzer
● In order to achieve the decapsulation of the original payload from the ERPM header. The below two methods are suggested :
1. Using Network Analyzer
○ Install any well-known Network Packet Analyzer tool which is open source and free to download.
○ Start capture of ERPM packets on the Sniffer and save it to the trace file (for example : erpmwithheader.pcap).
○ The Header that gets attached to the packet is 38 bytes long. In case of a packet with L3 VLAN, it would be 42 bytes
long. The original payload /original mirrored data starts from the 39
th
byte in a given ERPM packet. The first 38/42
bytes of the header needs to be ignored/ chopped off.
○ Some tools support options to edit the capture file. We can make use of such features (for example: editcap ) and
chop the ERPM header part and save it to a new trace file. This new file (i.e. the original mirrored packet) can be
converted back into stream and fed to any egress interface.
2. Using Python script
680
Port Monitoring