HP Encapsulated Remote Mirror (HP ERM)
HP ERM, Hewlett-Packard Encapsulated Remote Mirror protocol is used by the HPE (Hewlett-Packard Enterprise) switches based on ProVision ASICs formerly of the ProCurve family, now branded under Aruba Networks, a Hewlett Packard Enterprise company. Unlike Cisco RSPAN, HP ERM encapsulates the frames to be mirrored inside UDP datagrams with a proprietary header, allowing it to be transported over any IP network (like Cisco ERSPAN). Switches running K, KA, and KB firmwares since K.12.01 support this feature.
It's uncertain if this can be carried over IPv6 at this time. If someone can confirm, it would be appreciated.
Page is a work in progress.
Around January 2007 with the release of K.12.01, it was first available on switches running the K firmware. As of February 2017, no apparent change has been made to the protocol. HP ProCurve LAN products software feature matrix
XXX - Add example decoded traffic for this protocol here (as plain text or Wireshark screenshot).
The HP ERM dissector is partially functional with some bits as yet unknown and labeled such.
HPERM_Preferences only has one setting, the UDP port.
Example capture file
A complete list of HP ERM display filter fields can be found in the display filter reference
Show only the HP ERM based traffic:
You cannot directly filter HP ERM protocol while capturing. However, if you know the UDP port used (see above), you can filter on that one.
Capture only the HP ERM traffic over the default port (7932):
udp port 7932
Wireshark bug 7483 Better documents the protocol than merely unknown data.