HP Encapsulated Remote Mirror (HP ERM)

HP ERM, Hewlett-Packard Encapsulated Remote Mirror protocol is used by the HPE (Hewlett-Packard Enterprise) switches based on ProVision ASICs formerly of the ProCurve family, now branded under Aruba Networks, a Hewlett Packard Enterprise company. Unlike Cisco RSPAN, HP ERM encapsulates the frames to be mirrored inside UDP datagrams with a proprietary header, allowing it to be transported over any IP network (like Cisco ERSPAN). Switches running K, KA, and KB firmwares since K.12.01 support this feature.

It's uncertain if this can be carried over IPv6 at this time. If someone can confirm, it would be appreciated.

Page is a work in progress.


Around January 2007 with the release of K.12.01, it was first available on switches running the K firmware. As of February 2017, no apparent change has been made to the protocol. HP ProCurve LAN products software feature matrix

Protocol dependencies

  • UDP: HPERM uses UDP as its transport protocol. The common UDP port for HPERM traffic is 7932.

Example traffic

XXX - Add example decoded traffic for this protocol here (as plain text or Wireshark screenshot).


The HP ERM dissector is partially functional with some bits as yet unknown and labeled such.

Preference Settings

HPERM_Preferences only has one setting, the UDP port.

Example capture file

Display Filter

A complete list of HP ERM display filter fields can be found in the display filter reference

Show only the HP ERM based traffic:


Capture Filter

You cannot directly filter HP ERM protocol while capturing. However, if you know the UDP port used (see above), you can filter on that one.

Capture only the HP ERM traffic over the default port (7932):

 udp port 7932 

External links


Imported from https://wiki.wireshark.org/HPERM on 2020-08-11 23:14:46 UTC