Home > Switches > Monitoring and Reporting > Packet Captures and Port Mirroring on the MS Switch

Packet Captures and Port Mirroring on the MS Switch

Workstations in promiscuous mode can sniff LAN packets within their broadcast domain. A workstation connected to Cisco Meraki switches can capture these packets through port mirroring. This article will cover how to capture traffic passed by an MS switch, using the following steps:

  1. Enable port mirroring on your switch
  2. Connect a workstation on your destination port
  3. Capturing packets in promiscuous mode


Enable port mirroring on your switch

The most effective way to capture traffic passed on a given switchport is to mirror that port to another available port, so all traffic passed by the source port will be sent out on the mirrored destination port. The following steps outline how to mirror one or more ports on an MS switch:

  1. In Dashboard, navigate to Switch > Monitor > Switch ports.
  2. Select one or more ports to be mirrored. Note that multiple source ports can be mirrored to a single destination port.
  3. Click Mirror:

  4. Specify the destination mirror port, which will be used to capture traffic on the source ports. Note that both ports must be on the same switch, or within the same switch stack.
  5. Click Create port mirror:

Note: The MS switch does not support port mirrors involving aggregated ports.

Connect a workstation to your destination port

Physically connect a workstation to your destination port. Make sure DHCP is enabled on the host, and check that it receives a 169.254.X.X IP address.


Capturing packets in promiscuous mode

On the workstation, open a packet capture utility. Using Wireshark as an example, navigate to Capture > Options and select your Ethernet card. Click Start. 



Now that traffic is being captured, perform whatever network tests are necessary to generate traffic across the source ports. This traffic can now be analyzed on the destination port using the capture tool.

Port Mirror Egress Modes

On Meraki switches, there are two egress modes for port mirrors:

  • True egress
    • Native VLAN traffic is untagged
  • Tagged egress
    • Native VLAN is tagged


The following table lists support for the two modes:

True Egress MS22, MS42, MS220, MS320, MS350, MS410
Tagged Egress MS225, MS250, MS420, MS425


Last modified



This page has no classifications.

Explore the Product

Click to Learn More

Article ID

ID: 1167

Explore Meraki

You can find out more about Cisco Meraki on our main site, including information on products, contacting sales and finding a vendor.

Explore Meraki

Contact Support

Most questions can be answered by reviewing our documentation, but if you need more help, Cisco Meraki Support is ready to work with you.

Open a Case

Ask the Community

In the Meraki Community, you can keep track of the latest announcements, find answers provided by fellow Meraki users and ask questions of your own.

Visit the Community