ERSPAN ID - Adding Information to captured packets

edit

Hi Wireshark-Team,

Please allow a question regarding the following scenario:

• I am capturing several ERSPAN sessions on one interface
• ERSPAN header shows e.g. ID 10, or ID 20 etc.
• I can create coloring rules that color packets with ID 10 red and other with ID 20 blue etc.

I would like to add a note to each captured packet based on the ERSPAN ID. The ERSPAN ID does (in my setup) identify on which interface this packet was monitored/captured in my infrastructure as I have one ERSPAN session for each interface to be monitored.

Is there a way to e.g. add an additional column e.g. after the Lenght and Info field in which information can be added based on the ERSPAN ID, same as the coloring, just not with coloring but adding a kind of a note to the packet line.

Thanks for your answer.

Best regards, Robert