Wireshark · Display Filter Reference: Encapsulated Remote Switch Packet ANalysis

Field name	Description	Type	Versions
erspan.bso	Bad/Short/Oversized	Unsigned integer (16 bits)	2.2.0 to 4.4.2
erspan.cos	COS	Unsigned integer (16 bits)	2.6.0 to 4.4.2
erspan.direction	Direction	Boolean	1.0.0 to 2.0.16, 2.6.0 to 4.4.2
erspan.direction2	Direction	Unsigned integer (16 bits)	1.6.0 to 2.4.16
erspan.encap	Encap	Unsigned integer (16 bits)	2.2.0 to 4.4.2
erspan.ft	Frame Type	Unsigned integer (16 bits)	2.2.0 to 4.4.2
erspan.gra	Timestamp granularity	Unsigned integer (16 bits)	2.2.0 to 4.4.2
erspan.hw	Hardware ID	Unsigned integer (16 bits)	2.2.0 to 4.4.2
erspan.index	Index	Unsigned integer (32 bits)	2.2.0 to 4.4.2
erspan.o	Optional Sub headers	Unsigned integer (16 bits)	2.2.0 to 4.4.2
erspan.p	Has Ethernet PDU	Unsigned integer (16 bits)	2.2.0 to 4.4.2
erspan.pid.rsvd	Reserved	Unsigned integer (64 bits)	2.4.0 to 4.4.2
erspan.pid1.port_index	Port ID/Index	Unsigned integer (32 bits)	2.4.0 to 4.4.2
erspan.pid1.rsvd1	Reserved	Unsigned integer (32 bits)	2.6.0 to 4.4.2
erspan.pid1.vsmid	VSM Domain ID	Unsigned integer (32 bits)	2.4.0 to 4.4.2
erspan.pid3.port_index	Port ID/Index	Unsigned integer (32 bits)	2.4.0 to 4.4.2
erspan.pid3.rsvd1	Reserved	Unsigned integer (32 bits)	2.6.0 to 4.4.2
erspan.pid3.timestamp	Upper 32-bit Timestamp	Unsigned integer (32 bits)	2.4.0 to 4.4.2
erspan.pid4.rsvd1	Reserved	Unsigned integer (32 bits)	2.4.0 to 4.4.2
erspan.pid4.rsvd2	Reserved	Unsigned integer (32 bits)	2.4.0 to 4.4.2
erspan.pid4.rsvd3	Reserved	Unsigned integer (32 bits)	2.4.0 to 4.4.2
erspan.pid5.port_index	Port ID/Index	Unsigned integer (32 bits)	2.4.0 to 4.4.2
erspan.pid5.switchid	Switch ID	Unsigned integer (32 bits)	2.4.0 to 4.4.2
erspan.pid5.timestamp	Timestamp (seconds)	Unsigned integer (32 bits)	2.4.0 to 4.4.2
erspan.pid7.rsvd1	Reserved	Unsigned integer (32 bits)	2.6.0 to 4.4.2
erspan.pid7.source_index	Source Index	Unsigned integer (32 bits)	2.6.0 to 4.4.2
erspan.pid7.timestamp	Upper 32-bit Timestamp	Unsigned integer (32 bits)	2.6.0 to 4.4.2
erspan.platid	Platform ID	Unsigned integer (32 bits)	2.4.0 to 4.4.2
erspan.priority	Priority	Unsigned integer (16 bits)	1.0.0 to 2.4.16
erspan.reserved	Reserved	Unsigned integer (32 bits)	2.6.0 to 4.4.2
erspan.sgt	Security Group Tag	Unsigned integer (16 bits)	2.2.0 to 4.4.2
erspan.spanid	SpanID	Unsigned integer (16 bits)	1.0.0 to 4.4.2
erspan.timestamp	Timestamp	Unsigned integer (32 bits)	1.6.0 to 4.4.2
erspan.truncated	Truncated	Unsigned integer (16 bits)	1.6.0 to 4.4.2
erspan.unknown1	Unknown1	Unsigned integer (16 bits)	1.0.0 to 1.4.15
erspan.unknown2	Unknown2	Unsigned integer (16 bits)	1.0.0 to 2.0.16
erspan.unknown3	Unknown3	Unsigned integer (16 bits)	1.0.0 to 2.0.16
erspan.unknown4	Unknown4	Byte sequence	1.0.0 to 2.0.16
erspan.unknown5	Unknown5	Unsigned integer (16 bits)	1.6.0 to 2.0.16
erspan.unknown6	Unknown6	Byte sequence	1.6.0 to 2.0.16
erspan.unknown7	Unknown7	Byte sequence	1.6.0 to 2.0.16
erspan.version	Version	Unsigned integer (16 bits)	1.6.0 to 4.4.2
erspan.version.unknown	Unknown version, please report or test to use fake ERSPAN preference	Label	1.12.0 to 4.4.2
erspan.vlan	Vlan	Unsigned integer (16 bits)	1.0.0 to 4.4.2