We are setting our TIM's in a new environment and will no longer be able to use an APCON device as we have previously been using. We are looking to possibly use the ERSPAN mode and need to know if the TIM application will be compatible with the network port span mode of ERSPAN.
Release : 10.7.0
Officially, the TIM does not support the ERSPAN encapsulation. It is a Cisco proprietary protocol.
One of our other customer tried it. In that case, it is actually decapsulate the traffic and present the result on a regular SPAN port to the TIM.
Our understanding is that SPAN ports are ok so long as they pass the full bidirectional traffic for the endpoints to be monitored, and do not start truncating packets or things such like that.