Switching

in Junos switches (and some routers), you can configure ERSPAN as below to encapsulate mirrored traffic in GRE.

analyzer {
    a1 {
        input {
            ingress {
                interface ge-0/0/1.0;
            }
        }
        output {
            ip-address 20.1.1.2;
        }
    }
}

however, i don't seem to find any way to decapsulate in the destination switch before handing off to pcap device.

does Junos actually support the ERSPAN encap and decap as in IOS XE?

Encap yes, decap no. Junos wraps mirrored traffic in plain GRE with the analyzer output ip-address config, and the docs are explicit that the end device is expected to strip the encapsulation itself. There's no equivalent of the IOS XE erspan-destination session anywhere in Junos. Worth knowing it's also not a true ERSPAN Type II header on most platforms, just GRE, so a Cisco box expecting real ERSPAN framing won't interoperate cleanly either.

The closest tool is filter-based GRE decapsulation, a firewall filter action that terminates GRE on QFX5100, EX4600 and the newer EX4100/EX4400 models. It's built as a tunneling feature rather than a mirroring one though, so whether it hands the decapsulated payload cleanly to a port for your pcap device is something I'd lab-test before trusting in production.

Easiest path is to let the capture host do the work. Wireshark decodes GRE natively, it does love unwrapping a present.

good insight into Junos's port mirroring capability!👍

now i don't have to try interop with IOS XE switch.

while wireshark can decode GRE fine, some network visibility tools may not. this is why i need to take the switch capability into consideration when choosing one.

i tried the filter-based GRE decapsulation as below but seemed no effect in my new EX4000 switches.

• set firewall family inet filter filter-name term term-name from protocol gre
• set firewall family inet filter filter-name term term-name then decapsulate gre

is it only supported on the listed models? can routers also do the decap?