Unable to see Encapsulated Remote Mirroring (L3) vSphere Distributed Switch packets when capturing traffic in Wireshark

Products

• VMware vSphere ESXi

Issue/Introduction

The virtual destination running Wireshark does not see the Encapsulated Remote Mirror Encapsulated Remote Mirroring (L3) Source virtual machine’s traffic mirrored to a physical or virtual destination through an IP tunnel. i.e. Unable to see ICMP ping testing.

Environment

vSphere 8
vSphere 7

Cause

Wireshark does not have the correct Capture Interface filters applied to see the Encapsulated Remote Mirroring (L3) Source virtual machine’s traffic.

Resolution

Configure the destination capture interface capture filter to ip proto 0x2f in Wireshark to see the Encapsulated Remote Mirroring (L3) Source virtual machine’s traffic

Then apply display filters icmp as needed:

Note when selecting the Encapsulation Type for Encapsulated Remote Mirroring (L3) Source, GRE does not show the VLAN Header for the Encapsulated Remote Mirroring (L3) Source.

Use ERSPAN to see the VLAN header in Wireshark.

Additional Information

Capture filters (like tcp port 80) are not to be confused with display filters (like tcp.port == 80). The former are much more limited and are used to reduce the size of a raw packet capture. The latter are used to hide some packets from the packet list.