erspan(4) committed to -current

Contributed by rueda on 2025-05-14 from the pcaps happening dept.

erspan(4), the ERSPAN collection driver created by David Gwynne (dlg@) [and about which we recently reported] has been committed to the tree:

CVSROOT:	/cvs
Module name:	src
Changes by:	dlg@cvs.openbsd.org	2025/05/13 19:54:12

Modified files:
	sys/net        : if_gre.c 

Log message:
add support for the ERSPAN Type II protocol

ERSPAN is a specific GRE 0 protocol id with GRE sequence numbers
enabled, with it's own shim header, and then an Ethernet payload.

it is intended for use as a network based packet capture format,
but it's implemented as an Ethernet tunnel interface here. as an
interface, it reuses all the BPF based infrastructure and tooling
available to us. it's able to send packets too, which allows it to
be added as a span port to bridge/veb setups.

the driver can also act as a collector for any ERSPAN Type II packets
sent to it. it's also set up with an extra BPF DLT_LOOP interface
that includes the encapsulation headers so you can tell where the
encapsulated packets came from.

ok claudio@ sthen@

So now the new tool is available for all -current users to put through the paces. Development will continue in-tree, and if you need this tool, it is likely that your feedback is welcome.

Latest Articles

Fri, May 16
- 06:29 EdgeRouter 4 under OpenBSD with Failover WAN (0)
Thu, May 15
- 04:45 erspan(4) committed to -current (0)
Wed, May 14
- 17:35 Game of Trees 0.112 released (0)
- 05:21 OpenSMTPD 7.7.0p0 released (0)
Mon, May 12
- 10:02 erspan(4): ERSPAN Type II collection (0)
Sun, May 11
- 12:46 Improved ACPI WMI support (may be) incoming (0)
Thu, May 08
- 12:24 Optimisation of parallel TCP input (1)
Wed, May 07
- 11:38 bpflogd(8) imported into -current (0)
- 04:57 LLDP daemon and tool committed to -current (0)

Credits

Copyright © 2004-2008 Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to April 2nd 2004 as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]