Packet Capture Overview
如欲查看中文版本，请点击 这里
The packet capture utility can be used to observe live network traffic passed by Cisco Meraki devices. Since captures provide a live snapshot of traffic on the network, they can be immensely helpful in diagnosing and troubleshooting network issues. This article outlines how to remotely take a packet capture in Dashboard.
Cisco Meraki Support seeks prior written permission from a customer’s Organization Administrator or Network Administrator before initiating a packet capture on behalf of a customer.
Once a capture is complete, the data can only be accessed via the output selected. To ensure privacy and security, packet capture data is not stored in the Meraki cloud. > this is only applicable for traditional packet capture
Only Organization-wide and Network-wide administrator accounts will full access can use the packet capture tool. Read-only and monitor-only network administrator accounts will not be able to access this tool.
Learn more with this free online training course on the Meraki Learning Hub:
Capturing on Each Product
The packet capture tool is available under Network-wide > Monitor > Packet Capture. An additional dropdown will then be available to select which type of device to perform the capture on:
The following sections outline specific capture options for each product's capture utility.
Access Points
Intelligent Capture
Feature in development - details are subject to change
Traditional packet capture methodologies typically involve extensive manual intervention by network engineering teams, often including on-site and protracted sessions to capture network traffic. The efficacy of these manual captures in isolating and identifying evidence of network anomalies is relatively expensive, considering the investment in time and resources.
Intelligent Capture introduces a paradigm shift by automating the packet capture process. It enables network engineers to initiate and retrieve packet captures (PCAPs) on demand remotely. This system categorizes packet capture into three specific use-case scenarios.
What is the minimum requirement to enable this feature?
Intelligent Capture for MS - MS 17.1 or above
Intelligent Capture for MR - R30 or above
Proactive Packet Capture - R31 or above using Wi-Fi 6/6e or newer AP model*
Manual Packet Capture for MR- R27 or above supporting Wi-Fi 5/6/6e or newer AP models*
*excluding Meraki MR45/55 model
How to use the feature?
Opt-in for early access to our Proactive Packet Capture feature to get an exclusive first look and provide valuable feedback.
To access it, you would navigate to Network-wide → Intelligent capture (Originally Packet Capture) as shown below.
Navigation to Intelligent Capture
Manual Capture
This remains the same as the packet capture, with a refreshed page where you can select a particular AP or a set of APs to run a packet capture on, as shown in Figure 2. Now, this feature adds the benefit of saving the Packet capture file to the cloud. This PCAP stored in the cloud is available to download for 90 days with no additional cost for the user.
Note: A manual packet capture (PCAP) on the MR can collect up to 1000 packets.
New Intelligent Capture page, replacing old packet capture
In addition to the new enhancements, we've introduced a STOP button for the manual packet capture process. This feature offers greater control and flexibility by allowing you to halt packet captures at any time, precisely managing the capture duration and promptly ending the process as needed.
Proactive PCAP Enablement
Now for the exciting, straightforward part: Navigate to the Proactive PCAP Enablement tab and activate auto-capture. As shown in the figure below, you can choose to enable this feature on a per-AP basis, by tag, or for all devices.
Proactive PCAP Enablement
This feature will automate this process and generate PCAPs proactively upon any client connection or roaming failure situation. Users can access PCAP files whenever and anywhere they are needed. The automated packet captures will be limited to client association/authentication failures.
Requirement for MR-ADV License for Proactive Packet Capture:
To enable Proactive Packet Capture on your network, an MR-ADV (Advanced) license is required. This license unlocks advanced features, including automatically capturing network packets based on predefined triggers or conditions. This capability is crucial for proactive network monitoring and troubleshooting, allowing network administrators to address issues before they escalate into significant problems preemptively.
Retention Time for Proactive Packet Capture:
Captured packets are retained for 7 days. During this period, network administrators can access, analyze, and download the captured packet data to gain insights into network performance and diagnose issues. After the 7-day retention period, the captured data is automatically purged to make room for new captures, ensuring efficient use of storage resources.
The packet captures can be accessed from the Stored captures, as shown in the section below.
Stored Captures
This section stores all the packet captures, including both manual and proactive packet captures. The list, shown in Figure 4, shows the timestamp of the PCAP along with the client and failure reason that triggered the test reason for the Proactive PCAP on a particular AP. Users can also view and download any PCAP file by clicking the “…” Action button and hitting view/download. Also, clicking on the PCAP name will take you to the Packet viewer shown in the Figure below.
Stored Captures list in Intelligent Capture
Viewing Captures
To view a capture, click on the file name under the "Stored Captures" tab to open the embedded viewer. This viewer allows you to apply filters for quickly identifying interesting frames and selecting individual frames for detailed inspection.
Enter filter expressions into the filter field. Once you have entered a valid filter expression, click "Apply" to display only the frames that match the filter criteria in the frame list. Click "Clear" to remove the filter and display all frames from the capture.
Filter reference https://www.wireshark.org/docs/dfref/
https://community.cisco.com/t5/wireless-mobility-knowledge-base/802-11-frames-a-starter-guide-to-learn-wireless-sniffer-traces/ta-p/3110019
You can expand or collapse the decoded frame information in the bottom left-hand pane. Selecting a specific decoded field will highlight the corresponding frame bytes in the bottom right-hand pane. Click "OK" to close the viewer window.
Packet viewer
This same packet capture can be accessed from the Stored Capture Tab on the Clients page, as shown in Figure 6. To access this, you go to Network-wide → Clients → select the client you are troubleshooting → Select Stored Capture
Stored Packet captures from the Client view
The file name for Proactive Packet Capture is generated using the following components:
• Client MAC Address: Identifies the client device.
• Hash Value: Ensures uniqueness.
• Failure Step: Indicates the process step where the failure occurred.
• Failure Reason: Provides a brief description of the failure.
This systematic approach to file naming enhances the manageability and usability of captured packet data, enabling network administrators to efficiently diagnose and resolve network issues.
Example File Name Construction:
Suppose a packet capture is initiated due to an authentication timeout for a client device with the MAC address 00:1A:2B:3C:4D:5E. The hash value generated is "X1Y2Z3", the failure step is "Auth", and the failure reason is "Timeout". The resulting file name might look something like this:
00:1A:2B:3C:4D:5E_X1Y2Z3_Auth_Timeout
Timeline view
Usecase: A customer trying to identify how the network is operating by looking at
-
Assurance → Overview.
-
In the clients section select Wireless and you would see the list of Wireless client issues.
-
Select a type of issue and you will see list of clients
-
Select the client hyperlink and it will take you to the Client details page. This page will have Timeline and Stored Captures Tab. Select Timeline
This Timeline page will display a comprehensive list of all events that have occurred for this specific client. It serves as a detailed chronological record, providing a clear view of the client's connectivity history, including any issues or anomalies that have been detected.
Additionally, a Packet Capture Filter is available on this page, allowing you to refine the displayed events to only include those that have associated packet capture files triggered by Proactive Packet Capture.
Download or View Proactive PCAP from the Timeline RCA
Switches
The following options are available for packet captures on Switches:
-
Switch: Select the switch to run the capture on.
- Switch ports: Select the switch port(s) to run the capture on.
- Output: Select how the capture should be displayed; view output or download .pcap.
- Verbosity: Select the level of the packet capture (only available when viewing the output to the directly to Dashboard).
- Ignore: Optionally ignore capturing broadcast/multicast traffic.
- Filter expressions: Apply a capture filter.
A switch has the ability to run a packet capture on one or more switch ports at a time. Switch port mirroring can also be used for a longer duration capture. Please see this link for switch port mirroring configuration.
There is currently no capture size limit, besides a capture time of a maximum 60 seconds. Data is streamed live directly from the switch source interface(s) to the user's browser session (over HTTPS, 443). If there is more traffic being captured than the internet connection allows, the capture may be incomplete. In this case, a switch port mirror (span) is recommended.
Note that packet captures on access switch ports may show an 802.1q VLAN tag on ingress and egress traffic. This behavior is a consequence of how packet captures are performed on MS switches.
The Meraki MS120 and MS125 series switches do not support Dashboard-based packet captures on network switch ports connected to other Meraki MS switches within the same Dashboard Network.
WAN Appliances and Teleworker Gateways
The following options are available for packet captures on WAN appliances or Teleworker gateways:
- Security appliances: The WAN appliance or Teleworker gateway the capture will run on.
- Interface: Select the interface to run the capture on; the interface names will vary depending on the WAN appliance configuration. A few examples of interfaces you may see are:
- Internet 1 or Internet 2 - Capture traffic on one active WAN uplink. Internet 2 will only appear if there is a second WAN link.
- LAN - Captures traffic from all LAN ports
- Cellular - Captures cellular traffic from the integrated cellular interface. This does not apply to USB modems.
- Site-to-Site VPN - Captures AutoVPN traffic (WAN appliance/Teleworker gateway to WAN appliance/Teleworker gateway only). This does not apply to Non-Meraki VPN peers.
- Output: Select how the capture should be displayed; view output or download .pcap.
- Verbosity: Select the level of the packet capture (only available when viewing the output to the directly to Dashboard).
- Ignore: Optionally ignore capturing broadcast/multicast traffic.
- Filter expressions: Apply a capture filter.
The WAN appliance/Teleworker gateway allows users to capture on multiple different interfaces. A capture on the site-to-site VPN interface will contain all Meraki site-to-site VPN traffic (it will not contain 3rd party VPN traffic).
NOTE: WAN Appliances and Teleworker Gateways cannot capture traffic that they switch between LAN clients; only routed traffic, or broadcast and multicast traffic that is flooded on the LAN will be visible.
Capturing on Multiple Interfaces
When troubleshooting problems on the network, it is important to try and isolate any hardware that is not handling traffic appropriately. Simultaneous packet captures on multiple ports are useful because they allow the user to see a more complete picture of how traffic is flowing.
This article explains how to capture traffic simultaneously on multiple interfaces of a Meraki device, and how to analyze that traffic to detect potential issues
Intelligent Capture
Feature in development - details are subject to change
Packet captures enable you to make copies of frames passing through a network device for inspection. This is often useful for troubleshooting or forensic analysis. This article covers enhancements to previous versions of the Meraki packet capture utility provided by Cloud-based packet capture (Intelligent Capture)
Intelligent Capture allows you to capture, store, view, and download captures directly in Meraki dashboard. Start by navigating to the Network-wide > Packet Capture page:
Capturing
Creating a capture
From the New capture tab, set the following parameters to take a packet capture:
-
Choose the device you want to perform the capture and enter the port numbers where you want to perform the capture. You may specify ports as a comma separated list of ports or port ranges, for example: 1,4,5-30
- Choose the output for the saved capture. Regardless of which option is selected, the capture will also be saved to cloud for later reference.
- Save to cloud - save to Meraki Dashboard for storage and later reference.
- Download - download the capture to your workstation via your browser once the capture has completed.
- Quick View - Review the capture details in your browser once the capture has completed.
- Enter the duration to capture traffic in seconds, up to 300s (5 minutes).
- Enter filter expressions if desired to reduce the types of traffic that are captured.
- You can review examples of filter expressions by clicking on the View example filters link
- Use the copy link to optionally copy any of the sample expressions and paste into the capture filters field.
- You can review examples of filter expressions by clicking on the View example filters link
- Optionally override the automatically generated file name.
- Optionally add descriptive notes to attach to the capture.
- Once these options are configured as required, click the Start Capture button to begin the capture.
Capturing
Click the Start capture button to begin the capture. A progress bar will appear while traffic is being captured, and you can click Cancel capture to stop the capture early. Captures that are canceled early are still saved to cloud.
Once the capture is finished, choose to view or download the capture, create a new capture, or click See all captures to navigate to the Stored captures tab.
When a switch is under heavy load, in order to protect critical network services, some frames may not be captured.
Managing Stored Captures
The Stored captures tab allows you to view, download, or delete previously stored captures. The table lists various details about the capture, including:
- Time of capture
- File name
- Device and port the capture was performed on
- The user that created the capture
- Capture Status
- The output type
- Source
- File size
- Notes
There are a number of options to manage each capture:
- Click on the file name of the capture to open the embedded viewer
- Click the capture options button at the far right of the capture entry to view, download a copy, or delete the capture
Stored captures are retained for 90 days. After 90 days the capture files are automatically removed, while the capture entry remains in the list for historical reference. The view and download buttons are unavailable for captures that have been removed.
Viewing captures
Click on the file name of a capture on the Stored captures tab to open the embedded viewer. The viewer allows you to use filters to quickly identify interesting frames and select individual frames to inspect in detail.
Enter filter expressions into the filter field and the filter field background will turn light green for a valid expression, or light red when an invalid expression is entered. When entering protocol names such as ARP, ICMP, or STP, the viewer will search for and display matching protocols; click the displayed protocol name to auto complete the entry. Once a valid filter expression is entered, click Apply to display in the frame list only the frames that match the filter. Click Clear to remove the filter and display all of the frames from the capture.
Expand or collapse the decoded frame info in the bottom left hand pane. Selecting a particular decoded field highlights the corresponding frame bytes in the bottom right hand pane. Click Ok to dismiss the viewer window.
Capture Options
The dashboard provides users with multiple options when it comes to selecting which packets to capture and on which interface. You can also select how to view the capture to review the data.
Note: When performing a packet capture, it is recommended to use the Output > Download .pcap file (for Wireshark) option and open the resulting raw capture in Wireshark. When using this option, the Verbosity option is not available, because all traffic/information is captured.
Note: When the option Output > Download .pcap file (for Wireshark) is selected, the capture will stop after 60 seconds if there is no traffic captured, regardless of the duration set.
View Output in Web Browser
If you select to "View output below", it display basic data about the ingress/egress packets on the selected interface. If more detail is needed another output type should be selected.
Note: When selecting the option 'View output below,' the capture will stop after 20 seconds if there is no traffic captured, regardless of the duration set on the settings.
Verbosity level descriptions
When the option Output > View output below is chosen, the Verbosity option is used to determine how much detail should be output in the view below. These options correspond to the following flags in tcpdump.
Low -> (No flag)
Provides basic information about the packet's source, destination, and type.
Medium -> -v
When parsing and printing, produce (slightly more) verbose output. For example, the time to live, identification, total length and options in an IP packet are printed. Also enables additional packet integrity checks such as verifying the IP and ICMP header checksum.
High -> -vv
Even more verbose output. For example, additional fields are printed from NFS reply packets, and SMB packets are fully decoded.
Extra high -> -vvv
Even more verbose output. For example, telnet SB ... SE options are printed in full.
The whole ball of wax -> -X
When parsing and printing, in addition to printing the headers of each packet, print the data of each packet (minus its link level header) in hex and ASCII. Note that use of this flag generates a great deal of output, and should only be used if needed.
Download .pcap
You can download a packet capture file to your local computer by selecting Download .pcap file (for Wireshark). This file can then be opened with a program such as Wireshark seconds that can be specified for the capture length. With MR products, the maximum amount of packets captured is 100,000.
Additional information on how to filter and utilize the .pcap file can be found in the Wireshark Wiki
Rolling Captures
A "Rolling Capture" is a capture which automatically saves the output to files at set intervals and can break up a large capture into multiple smaller files. This can be extremely useful when trying to run a long-term capture for troubleshooting intermittent troubles such as choppy audio on VOIP.
Best Way to Run Rolling Captures
For some issues, it may be necessary to perform port mirrors or span port captures which run for long periods of time until the issue occurs. The goal is to run a capture and once the issue surfaces stop the packet capture. If a packet capture is run for a long duration of time, 6 hours, for example, the .pcap file will be too large for your computer to open as captures larger than 100mb become too difficult to open on some computers. To mitigate this trouble, the capture can be set with multiple different options which makes this easier.
What is the Ring Buffer
Ring Buffers can be set to ensure that you will not fill up all of the disk space on your device. It will start overwriting the oldest file based on how many files you specify. This does not have to be used, but it is useful to ensure you do not fill up your HDD.
Taking a Rolling Capture
- Open Wireshark.
- Click Capture Options.
- Uncheck "Enable promiscuous mode on all interfaces", check the "Promiscuous" option for your capture interface and select the interface.
- In the "Output" tab, click "Browse...".
- Enter a filename in the "Save As:" field and select a folder to save captures to. Click Save.
- Select "Create a new file automatically after..." and "Use a ring buffer with x files". This creates a maximum of x number of files, with each file set to the size or timeframe configured. For example, creating a new file automatically after 32 megabytes, with a ring buffer of 128 files, will provide 4 gigabytes of rolling captures.
- Click start. This will take you to a new window that will show the packets that the device is picking up.