This is our old Q&A Site. Please post any new questions and answers at

When viewing erspan packets in wireshark, I get malformed packets. The packet are good, but wireshark is not interpreting the packet correct.

Packet is formed : EtherII - ip - gre - erspan - etherII - IP - ipdata The first etherII has a trailer of 32 bytes, which is odd the ip headers have the correct 'total length', taking into account the extra 32 bytes of the (etherII-ip-gre-erspan) headers the last ip header shows the correct length, the same as the original packet before encapsulation.

ex an ICMP packet: the ipdata portion of the original ip packet 80 bytes total length with 20bytes header, leaving 60 bytes for the icmp packet. Icmp has an 8 byte header, leaving 52 bytes of data, but wireshark reports 20 bytes, which is 32 bytes too short

I guess this is a bug in wireshark parsing, put I'm not sure how to report it


asked 25 Jun '14, 07:02

PieterL's gravatar image

accept rate: 0%

Second entry from Google search of "wireshark bugs", on the wiki: Reporting Bugs.

permanent link

answered 25 Jun '14, 08:35

grahamb's gravatar image

grahamb ♦
accept rate: 22%

Link to the bugreport It is not a Wireshark bug, but a Cisco bug.

(08 Dec '14, 14:23) PieterL
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 25 Jun '14, 07:02

question was seen: 2,446 times

last updated: 08 Dec '14, 15:07

p​o​w​e​r​e​d by O​S​Q​A