Root permissions for the source machine are required. This approach has been tested on Debian 12 with kernel 6.1.0-11.

ERSPAN mirroring can be configured with these commands (run on the machine whose traffic should be mirrored, not on the Flowmon appliance):

# Create an ERSPAN interface named 'myerspan'
# - local: Source IP address for the ERSPAN tunnel
# - remote: Destination IP address where mirrored traffic will be sent
# - seq: Enable sequence numbers with key 1
# - erspan_ver 1: Use ERSPAN version 1
# - erspan 1: Set ERSPAN ID to 1
ip link add dev myerspan type erspan local 172.16.32.2 remote 172.16.32.1 seq key 1 erspan_ver 1 erspan 1

# Bind the ERSPAN interface to physical interface ens224
# This ensures ERSPAN tunnel traffic uses ens224 instead of the monitored interface
ip link set myerspan master ens224

# Add an ingress qdisc (queue discipline) to interface ens192
# This is required to capture incoming traffic on the monitored interface
tc qdisc add dev ens192 handle ffff: ingress

# Add a filter for incoming traffic on ens192
# - matchall: Capture all traffic
# - skip_hw: Skip hardware acceleration
# - action mirred egress mirror: Mirror the traffic
# - dev myerspan: Send mirrored traffic to ERSPAN interface
tc filter add dev ens192 parent ffff: matchall skip_hw action mirred egress mirror dev myerspan

# Add a root qdisc for outgoing traffic on ens192
# 'prio' type allows traffic prioritization
tc qdisc add dev ens192 handle 1: root prio

# Add a filter for outgoing traffic on ens192
# Similar to the ingress filter, but captures outbound traffic
# All outgoing traffic will be mirrored to the ERSPAN interface
tc filter add dev ens192 parent 1: matchall skip_hw action mirred egress mirror dev myerspan

# Activate the ERSPAN interface
# Interface must be up for the mirroring to work
ip link set myerspan up

These commands set up port mirroring where:

• ens192 is the monitored interface (source of the traffic to be mirrored)
• ens224 is the transport interface (carries the ERSPAN tunnel to avoid traffic loops)
• myerspan is the ERSPAN interface that encapsulates the mirrored traffic
• All traffic (both incoming and outgoing) on ens192 will be mirrored via ERSPAN

Remember to ensure proper IP configuration and routing on ens224 to reach the remote destination (172.16.32.1).

The monitoring port of the Flowmon appliance has to have an IP address configured, and ERSPAN decapsulation has to be enabled there.

https://medium.com/swlh/traffic-mirroring-with-linux-tc-df4d36116119