ERSPAN mirrors traffic to a destination interface on a remote Vyatta router. Similar to RSPAN, ERSPAN mirroring has source and destination Vyatta router. However, it uses an ERSPAN tunnel to transmit mirrored packets from the source vRouter to the destination vRouter. The tunnel is configured with local and remote IP addresses and is dedicated to transporting mirrored traffic to the remote vRouter.
On the source vRouter, traffic from source interfaces is mirrored and prepended by Type II or Type III headers. These headers are defined in the following IETF draft proposal.
Then, the ERSPAN on the source vRouter sends the traffic to the tunnel. ERSPAN on the destination router receives the mirrored traffic from the tunnel and forwards it to a destination interface on this router for traffic analysis.
Source interfaces are physical interfaces. Both ingress and egress traffic on source interfaces can be mirrored. For an ERSPAN destination session, the destination interface is a physical port to which a network monitoring tool is connected for capturing and analyzing the traffic.
The following figure shows an ERSPAN port mirroring session on source and destination Vyatta router.