Wireshark-bugs: [Wireshark-bugs] [Bug 5244] Add Dissector for ERSPAN Type-III Header
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5244
--- Comment #19 from Jason Masker <jason@xxxxxxxxxx> 2010-09-24 11:39:28 PDT ---
(In reply to comment #18)
> The first three packets seem to contain the same captured packet, but they are
> a bit confusing regarding the direction bit. Do they make sense to you?
Session 111 is capturing from the perspective of the SVI (switch virtual
interface) which is the VLAN routing interface. (I had to do this capture at my
core.) Unfortunately because the SVI interfaces are not like a typical
interface the packet is technically always outbound from the switch at the
point of capture. Forgive me, it is not the best example but because this
particular host aggregates through a 10GE link it was not practical for me to
capture the physical interface on the core. Just know that the direction bit
which is set to outgoing is indeed the direction bit that switches for ERSPAN
captures from this device. Take this in contrast to spanid 222 which is alsy
the version 1 header, but here we can clearly see the direction bit in the
first byte of the Unknown4 header.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
