Dell S4048T, Configuration Manual

Page: 807 / 1277

If the sniffer does not support IP interface, a destination switch will be needed to receive the encapsulated
ERPM packet and locally mirror the whole packet to the Sniffer or a Linux Server.
Decapsulation of ERPM packets at the
Destination IP/ Analyzer
• In order to achieve the decapsulation of the original payload from the ERPM header. The below two
methods are suggested :
a
Using Network Analyzer
• Install any well-known Network Packet Analyzer tool which is open source and free to
download.
• Start capture of ERPM packets on the Sniffer and save it to the trace file (for example :
erpmwithheader.pcap).
• The Header that gets attached to the packet is 38 bytes long. In case of a packet with L3
VLAN, it would be 42 bytes long. The original payload /original mirrored data starts from the
39
th
byte in a given ERPM packet. The first 38/42 bytes of the header needs to be ignored/
chopped off.
• Some tools support options to edit the capture file. We can make use of such features (for
example: editcap ) and chop the ERPM header part and save it to a new trace file. This new
file (i.e. the original mirrored packet) can be converted back into stream and fed to any egress
interface.
b Using Python script
• Either have a Linux server's ethernet port ip as the ERPM destination ip or connect the ingress
interface of the server to the ERPM MirrorToPort. The analyzer should listen in the forward/
egress interface. If there is only one interface, one can choose the ingress and forward
interface to be same and listen in the tx direction of the interface.
• Download/ Write a small script (for example: erpm.py ) such that it will strip the given ERPM
packet starting from the bit where GRE header ends. Basically all the bits after 0x88BE need to
be removed from the packet and sent out through another interface.
• This script erpm.zip is available for download at the following location:
http://en.community.dell.com/techcenter/networking/m/force10_networking_scripts/20438882.aspx
• Unzip the erpm.zip and copy the erpm.py file to the Linux server.
• Run the python script using the following command:
python erpm.py -i <ingress interface> -o <egress interface>
erpm.py : This is the script downloaded from the script store.
<Ingress interface> : Specify the interface id which is connected to the mirroring port or this should be
interface whose ip address has been specified as the destination ip address in the ERPM session.
Port Monitoring 807