Hi,

I’m observing a regression in ERSPAN support between older and current versions of heplify.

Summary

ERSPAN (GRE, protocol 0x88BE, Type II) traffic is correctly decoded in version 1.56, but not decoded in the latest version (2.x). As a result, SIP packets are not detected and no HEP traffic is sent.

Environment

• Deployment: Docker (network_mode: host)
• Interface: ens32
• Traffic source: ERSPAN (GRE) mirror from network device
• ERSPAN type: Type II (gre-proto-0x88be)
• HEP server: running locally (127.0.0.1:9060)

Command used

./heplify -e -print -hs 127.0.0.1:9060 -m SIPRTP -i ens32 -zf -l debug -erspan

Behavior in latest version (2.x)

• GRE traffic is visible
• No SIP packets detected
• No HEP packets sent

Example logs:

per-minute packet stats ... sip=0 hep_sent=0 total=28 rtcp_fail=28

Behavior in version 1.56

Using the Docker image:

sipcapture/heplify:1.56

With the same configuration and traffic:

• SIP packets are correctly detected
• HEP traffic is sent as expected

Verification (tcpdump)

tcpdump -ni ens32 proto gre
IP source_ip > <host_ip>: GREv0, ... gre-proto-0x88be

Expected behavior

Since ERSPAN support is documented (-erspan Enable ERSPAN support), I expect:

• Proper decapsulation of ERSPAN Type II (0x88BE)
• SIP detection from inner payload
• HEP forwarding

Actual behavior

• ERSPAN packets are received
• Inner payload is not decoded
• SIP remains 0

Question

Was ERSPAN Type II support changed or partially removed in 2.x?

Is there any additional configuration required in newer versions to properly decode ERSPAN traffic?

Thanks in advance for your help.