GigaSMART Header Stripping

Required License: Header Stripping

GigaSMART operations with a Strip Header component can identify and remove headers from tagged packets or headers and trailers from tunneled (encapsulated) packets.

The following types of packets can be stripped:

■   Header Stripping – Remove headers from ERSPAN, MPLS, MPLS+VLAN, VLAN, VN-Tag, VXLAN, GRE, tagged packets, Cisco FabricPath Headers, or FM6000 timestamps before they are sent to tool ports. This feature is handy when working with tools that either cannot recognize these headers or have to engage in additional processing to adjust for them. Figure 1 shows the GigaSMART Operations page for configuring header stripping.
■   Tunnel Stripping – Remove both the header and trailer of ISL or GTP-encapsulated packets, preserving the packet within for analysis. This is handy when sending data to tools that cannot parse the ISL or GTP tunnel information and analyze the packets within. Figure 2 shows an example of the GS Operations page configured for tunnel stripping.

Figure 52 Strip Header GigaSMART Operation Configured

Figure 53 Tunnel Stripping GigaSMART Operation Configured

You can also use the Strip Header feature in tandem with the Add VLAN component to differentiate stripped packets from non-stripped packets. This is particularly useful when seeing stripped/non-stripped packets on common IP ranges (10.x.x.x; 192.168.x.x). Refer to the following table for more information.

Keep in mind the following when configuring GigaSMART operations with a Strip Header component:



ERSPAN Header Stripping

The ERSPAN header can be stripped. Specify an ERSPAN flow ID, from 0 to 1023. Use this option to strip ERSPAN Type II and Type III headers. A flow ID of zero is a wildcard value that matches all flow IDs.

Cisco FabricPath Header Stripping

The Cisco FabricPath headers can be stripped. The ability to decapsulate all packets with Cisco FabricPath headers; that is, all packets matching a destination switch ID and source switch ID. Also apply filters based on outer src/dst switch ID or ability to filter based on inner packet parameters with or without decapsulating the packet.

The Fabric Switch ID Source and Fabric Switch ID Destination attributes are mandatory. Enter a value from 0 to 4095 (<0~(2^12-1)>) for a 12-bit switch ID. Enter 0 to strip all switch IDs.

FM6000 Timestamp Header Stripping

Packets entering GigaSMART from other devices may contain FM6000 timestamps. FM6000 is an Intel chip used for timestamping. The FM6000 timestamp can be stripped or it can be converted to UTC and appended to one of two Gigamon timestamping trailer formats.

FM6000 has a hardware timestamp in the packet. For GigaSMART, the hardware timestamp needs to be translated into UTC time. An FM6000 device sends time mapping information in separate control packets called keyframes, which enable the UTC timestamp to be calculated. The calculated UTC timestamp can then be appended to the packets as a trailer.

There are three timestamp formats: None, or GigaSMART, and X12-TS (for PRT-H00-X12TS). If the timestamp format is none, the FM6000 timestamp is stripped from the packet. If the timestamp format is GigaSMART or X12-TS, the FM6000 timestamp is stripped, converted to UTC, and a trailer containing the UTC timestamp is appended to the packets.

The GigaSMART timestamp is added to the GigaSMART trailer. For the format of the GigaSMART trailer, refer to GigaSMART Trailer Reference. The X12-TS timestamp is added to the PRT-H00-X12TS trailer. For the format of the PRT-H00-X12TS trailer, refer to GigaVUE-OS CLI Reference Guide.


■   FM6000 timestamp header stripping only supports an FM6000 timestamp that is present in the packet before the Frame Check Sequence (FCS). Packets containing an FM6000 timestamp that overwrites the existing FCS are discarded. Packets with a bad FCS are also discarded.
■   Keyframes must only be sent to GigaSMART from one FM6000 device. If there are multiple FM6000 devices, their clocks must be synchronized using PTP.
■   The GigaVUE node maintains the keyframe database per GigaSMART operation (gsop). There is a one-to-one mapping of the keyframe database to each map associated with an FM6000 gsop. Ten (10) maps with an FM6000 gsop are supported per GigaSMART engine.
■   The keyframe rate on the FM6000 device is important. If GigaSMART does not see the keyframe, the time that is converted and appended to the header will be a default start time (1969). In certain conditions, the keyframe rate on the FM6000 device might need to be increased so that GigaSMART does not miss seeing this frame.

For an FM6000 timestamping example, refer to Example – FM6000 Timestamping.

GRE Header Stripping

By specifying a GigaSMART Operation with a GSOP type of Strip Header GRE, the GigaSMART can strip GRE headers. It will automatically strip either Layer 3 or Layer 2 headers depending on the incoming packet.

Layer 3 – The GigaSMART can strip the outer IPv4 delivery header and the GRE header to expose the encapsulated packet. Only IPv4 as the delivery protocol is supported. Any packet inside the GRE tunnel will be exposed, including IPv6 payloads. For an example, refer to Example – Stripping Layer 3 GRE IP Encapsulated Packets.

Layer 2 – The GigaSMART can strip GRE MPLS encapsulated and GRE Ethernet encapsulated packets, as follows:

■   GRE MPLS encapsulation – strip outer Ethernet header, outer IP header, GRE header, and MPLS header.
■   GRE Ethernet encapsulation (Transparent Ethernet Bridging) – strip outer Ethernet header, outer IP header, and GRE header. For an example, refer to Example – Stripping Layer 2 GRE Ethernet Encapsulated Packets.

Maximum MPLS Label Stack

The GigaSMART can strip MPLS headers up to a depth of seven labels.

Supported VLAN Types

The GigaSMART can strip both 802.1Q and Q-in-Q VLAN headers.

Refer to How to Handle Q-in-Q Packets in Maps.

VXLAN Stripping

GigaSMART can strip VXLAN (Virtual eXtensible Local Area Network) headers. You can strip either matching VXLAN headers or all VXLAN headers. Select Strip Header from the GigaSMART Operation, select VXLAN for the protocol and use the following value in the Vxlan Id field: 0~(2^24-1).

The VXLAN header is 8 bytes long with a 3-byte VXLAN Network Identifier (VNI) field. The VNI field is matched with the configured value and if it matches, the outer header (L2+IP+UDP+VXLAN) is stripped and the inner frame is sent to the tool.

Specify a value of 0 to strip all outer VXLAN headers.

Note:  When processing packets with multiple encapsulation layers – for example, an ERSPAN-tunneled packet with a VXLAN tag – a VXLAN header-stripping operation will strip all the way to the end of the VXLAN layer instead of just the VXLAN tag.

ISL Tunnel Stripping

ISL tunnel stripping removes the 26-byte header and the 4-byte FCS trailer associated with Cisco ISL VLAN encapsulation.

Important: Make sure the packets processed by a GigaSMART operation with a Strip Header ISL component are all using ISL encapsulation. GigaSMART operations do not distinguish between packets using ISL and packets that do not – it strips the requisite bytes from all packets it processes.

GTP Tunnel Stripping

GTP tunnel stripping removes the header and trailer for GTP-u packets inside the GTP tunnel between the SGSN and GGSN interfaces in a 3G network, and between the eNodeB (eNb) and the SGW and between the SGW and the PGW in an LTE network.

The SGSN and GGSN interfaces are also referred to as the Gn (or Gp) interface.

The interface between eNb and SGW is referred to as S1U. The user plane interface between SGW and PGW is referred to as S5-U/S8-U. Both use GTPv1.

Both GTPv1 and GTPv0 are supported for stripping. GTP-c control packets are not stripped. GTP1 (also referred to as “GTP-Prime”) is not supported for stripping.

Ethertype Replaced

After the VLAN/MPLS headers are stripped, the original ethertype carried in the Layer Two header is no longer valid. The GigaSMART replaces the ethertype field differently for MPLS and VLAN packets:

Ethertype Replacement for VLAN Packets

VLAN-tagged packets carry the original value for the ethertype field immediately after the VLAN tag. After the four-byte VLAN header is stripped, GigaSMART simply sets the ethertype field in the Layer 2 header to the value that was originally present in the packet past the VLAN tag.

Ethertype Replacement for MPLS Packets

Unlike VLAN-tagged packets, the Layer 3 protocol type is not carried in the packet for an MPLS packet – instead, it is applied by an egress router. To handle this, the GigaSMART examines the byte following the MPLS header to determine whether the packet is IPv4/IPv6 and takes the following actions:

o IPv4 – The GigaSMART replaces the ethertype from the MPLS packet with the IPv4 ethertype (0x0800)
o IPv6 – The GigaSMART replaces the ethertype from the MPLS packet with the IPv6 Ethertype (0x86DD).
o Non-IPv4/IPv6 – The GigaSMART passes the packet to destination tool ports without stripping the header. MPLS header stripping is only supported for IPv4/IPv6 packets.

CRCs Recalculated

The GigaVUE H Series node automatically recalculates and applies correct CRC checksums based on the new packet length after the header is stripped.

Viewing Statistics

From the device view, select GigaSMART > GigaSMART Operations (GSOPS) > Statistics to see statistics related to ongoing header stripping operations. Refer to View GigaSMART Statistics for more information.

Combine with Other Components

You can combine the Strip Header component with other GigaSMART components in a single operation. Refer to How to Combine GigaSMART Operations for details on the combinations of GigaSMART operations. Refer to Order of GigaSMART Operations for information on the order in which components of a single GigaSMART operation are applied.

GigaSMART Engine Ports

Header stripping operations can be assigned to GigaSMART groups consisting of multiple engine ports. Refer to Groups of GigaSMART Engine Ports for details.


Use Generic Header Stripping to remove any arbitrary header from a packet by specifying the offset and the length of the header. For information about Generic Header Stripping, refer to Generic Header Stripping.