# erspan decapsulation **URL:** \ **Category:** Zeek\ **Created:** [April 14, 2015, 2:57pm UTC](https://community.zeek.org/t/erspan-decapsulation/3553 "2015-04-14T14:57:40Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Giedrius\_Ramas](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@Giedrius\_Ramas](https://community.zeek.org/u/Giedrius_Ramas)\ **Post date:** [April 14, 2015, 2:57pm UTC](https://community.zeek.org/t/erspan-decapsulation/3553/1 "2015-04-14T14:57:40Z")
Hello, we have problems with ERSPAN package. Is there anyway BRO could understand them ? ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [April 15, 2015, 12:09pm UTC](https://community.zeek.org/t/erspan-decapsulation/3553/2 "2015-04-15T12:09:08Z")
Could you privately provide us a small packet capture of ERSPAN packets?   .Seth ---
**Author:** ![Giedrius\_Ramas](https://avatars.discourse-cdn.com/v4/letter/g/59ef9b/32.png) [@Giedrius\_Ramas](https://community.zeek.org/u/Giedrius_Ramas)\ **Post date:** [April 16, 2015, 7:57am UTC](https://community.zeek.org/t/erspan-decapsulation/3553/3 "2015-04-16T07:57:13Z")
Thanks for reply, I just figure out that I need to skip some bytes of package header. In my current case I need to skip 22 bytes. So I edited ini-bare.bro file and changed encap\_hdr\_size = 0 line to encap\_hdr\_size = 22 . BRO can now understand traffic. Do not know if I made a correct fix. Let me know if it is not a right way to do . ---
**Author:** ![dataolle](https://avatars.discourse-cdn.com/v4/letter/d/53a042/32.png) [@dataolle](https://community.zeek.org/u/dataolle)\ **Post date:** [April 16, 2015, 2:46pm UTC](https://community.zeek.org/t/erspan-decapsulation/3553/4 "2015-04-16T14:46:05Z")
It should be ok to chop off the first bytes. ERSPAN is basically cisco rspan with a GRE encapsulation. I have been using GULP ([https://staff.washington.edu/corey/gulp/](https://staff.washington.edu/corey/gulp/)) and piping from gulp to bro -r - but your method is much cleaner way of doing it. Beware of not MTU issues though, since packets might get chopped off at the end if they do not fit after the GRE encapsulation //K ---
**Author:** ![dataolle](https://avatars.discourse-cdn.com/v4/letter/d/53a042/32.png) [@dataolle](https://community.zeek.org/u/dataolle)\ **Post date:** [April 16, 2015, 3:15pm UTC](https://community.zeek.org/t/erspan-decapsulation/3553/5 "2015-04-16T15:15:47Z")
However, to me it looks like 50bytes instead of 22 bytes? Like in this: [https://staff.washington.edu/corey/gulp/conv.c](https://staff.washington.edu/corey/gulp/conv.c) But i guess bro deencapsulates the gre tunnel for you? //K ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [April 16, 2015, 8:14pm UTC](https://community.zeek.org/t/erspan-decapsulation/3553/6 "2015-04-16T20:14:57Z")
Yep. Bro supports GRE.   .Seth ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [April 16, 2015, 8:15pm UTC](https://community.zeek.org/t/erspan-decapsulation/3553/7 "2015-04-16T20:15:25Z")
Ideally we’d just support ERSPAN natively, but there’s nothing wrong with your solution.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/erspan-decapsulation/3553/8 "2022-05-06T15:42:35Z")
Closed on May 6, 2022, 3:42pm UTC