You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi,
TL;DR;
Is it possible to assign an IP-address to the capture interface on a SO sensor-node?
Reason I'm asking: Since I can't work with a local mirror setup, i.e. SPAN from one switchport to another on the same Switch Cisco Nexus9000 switch, I thought about setting up ERSPAN, i.e. traffic coming from one switchport (source) to a particular IP-address somewhere else; so the destination is not a local switchport but whoever is holding the destination IP-address. Basically it's "tunneling" traffic originating from one switchport to an IP-address.
My idea was to assign this "destination IP" of the ERSPAN-config to the capture interface of the SO pcap-machine ("sensor"), so that traffic originating from a port on one switch ends up at the switchport (on another LAN switch) where the SO pcap machine is connected.
Is this setup, i.e. IP-address on the capture interface, possible at all?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
-
Hi,
TL;DR;
Is it possible to assign an IP-address to the capture interface on a SO sensor-node?
Reason I'm asking: Since I can't work with a local mirror setup, i.e. SPAN from one switchport to another on the same Switch Cisco Nexus9000 switch, I thought about setting up ERSPAN, i.e. traffic coming from one switchport (source) to a particular IP-address somewhere else; so the destination is not a local switchport but whoever is holding the destination IP-address. Basically it's "tunneling" traffic originating from one switchport to an IP-address.
My idea was to assign this "destination IP" of the ERSPAN-config to the capture interface of the SO pcap-machine ("sensor"), so that traffic originating from a port on one switch ends up at the switchport (on another LAN switch) where the SO pcap machine is connected.
Is this setup, i.e. IP-address on the capture interface, possible at all?
Thanks much in advance for any clue...
Beta Was this translation helpful? Give feedback.
All reactions