On (2012-05-24 15:34 +0000), Per Granath wrote: > That's right. You would need to look at port mirroring, or sampling.
Mirroring over GRE directly to your linux tshark box is quick to set up and really simply. Excellent feature indeed. Only problem is, in JNPR you cannot send L2 traffic over GRE. And there indeed isn't standard way to do this, as GRE relies on ethertype and then will contain what ever payload is. And there isn't ethertype for 'original frame'. Cisco has cute solution to this called ERSPAN, they use cisco-reserved ethertype and then small shim header telling where it was mirrored etc. Someone really should write IETF draft on ERSPAN equivalent, so we could add it to our RFQs. -- ++ytti _______________________________________________ juniper-nsp mailing list juniper-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/juniper-nsp
