# Bro decapsulating ERSPAN (GRE) **URL:** \ **Category:** Zeek\ **Created:** [October 31, 2018, 5:37pm UTC](https://community.zeek.org/t/bro-decapsulating-erspan-gre/5512 "2018-10-31T17:37:32Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Matt\_Thoreson](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Matt\_Thoreson](https://community.zeek.org/u/Matt_Thoreson)\ **Post date:** [October 31, 2018, 5:37pm UTC](https://community.zeek.org/t/bro-decapsulating-erspan-gre/5512/1 "2018-10-31T17:37:32Z")
Hello, I’ve got a vmware instance of Ubuntu running Bro 2.6-beta2. I want bro to monitor the eth0 interface that is directly receiving ERSPAN (gre tunneled) data from a Cisco switch. I’ve tried a few different scenarios. I thought Bro could by default recognize and decapsulate the real traffic from the GRE tunnel (according to the bro notes it should be able to do this) but so far when bro runs it just sees the gre traffic in it’s weird.log. I’ve also tried creating another tunnel interface tun0 set up as GRE on the Ubuntu instance and have the traffic forwarded from eth0 to tun0 and have linux decapsulate it. That is not working either. Has anyone gotten something similar to work reading cisco ERSPAN traffic into bro? ---
**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\ **Post date:** [October 31, 2018, 6:07pm UTC](https://community.zeek.org/t/bro-decapsulating-erspan-gre/5512/2 "2018-10-31T18:07:31Z")
It currently only handles a few GRE protocol types, and doesn't seem the ERSPAN ones are among them. - Jon ---
**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\ **Post date:** [October 31, 2018, 9:32pm UTC](https://community.zeek.org/t/bro-decapsulating-erspan-gre/5512/3 "2018-10-31T21:32:32Z")
To clarify that further: I totally missed that the changelog does say ERSPAN support was implemented, but I was just looking at the actual code, which does not seem to handle ERSPAN Type II or III (protocol types 0x88BE, 0x22EB). The associated commit seems to instead handle Transparent Ethernet Bridging (protocol type 0x6558). Not sure if I'm missing something. Or if you can give a pcap to test against, that could help to verify what's going and also serve as test case for fixing anything that's broken/unimplemented in Bro. - Jon ---
**Author:** ![Matt\_Thoreson](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@Matt\_Thoreson](https://community.zeek.org/u/Matt_Thoreson)\ **Post date:** [November 1, 2018, 2:45pm UTC](https://community.zeek.org/t/bro-decapsulating-erspan-gre/5512/4 "2018-11-01T14:45:47Z")
For what it’s worth I tried to stripping 50 bytes off the header in the init-bar.bro file in the encap\_hdr\_size=50 line. That seems to be the magic number with this unusual erspan gre header size. After doing that, bro is recognizing and splitting all the logs out properly. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/bro-decapsulating-erspan-gre/5512/5 "2022-05-06T15:46:09Z")
Closed on May 6, 2022, 3:46pm UTC