Home > Switches > Monitoring and Reporting > Packet Captures and Port Mirroring on the MS Switch

Packet Captures and Port Mirroring on the MS Switch

Work stations in promiscuous mode can sniff LAN packets within their broadcast domain. A workstation connected to Cisco Meraki switches can capture these packets through port mirroring. This article will cover how to capture traffic passed by an MS switch, using the following steps:

  1. Enable port mirroring on your switch
  2. Connect a workstation on your destination port.
  3. Capturing packets in promiscuous mode

Enable port mirroring on your switch

The most effective way to capture traffic passed on a given switchport is to mirror that port to another available port, so all traffic passed by the source port will be sent out on the mirrored destination port. The following steps outline how to mirror one or more ports on an MS switch:

  1. In Dashboard, navigate to Switch > Monitor > Switch ports.
  2. Select one or more ports to be mirrored. Note that multiple source ports can be mirrored to a single destination port.
  3. Click Mirror:

     
  4. Specify the destination mirror port, which will be used to capture traffic on the source ports. Note that both ports must be on the same switch, or within the same switch stack.
  5. Click Create port mirror:
     

Connect a workstation to your destination port

Physically connect a workstation to your destination port. Make sure DHCP is enabled on the host, and check that it receives a 169.254.X.X IP address.

Capturing packets in promiscuous mode

On the workstation, open a packet capture utility. Using Wireshark as an example, navigate to Capture > Options and select your Ethernet card. Click Start. 

 

Now that traffic is being captured, perform whatever network tests are necessary to generate traffic across the source ports. This traffic can now be analyzed on the destination port using the capture tool.

Port Mirror Egress Modes

On Meraki switches, there are two egress modes for port mirrors:

  • True egress
    • Native VLAN traffic is untagged
  • Tagged egress
    • Native VLAN is tagged

 

The following table lists support for the two modes:

True Egress MS22, MS42, MS220, MS320, MS350, MS410
Tagged Egress MS225, MS250, MS420, MS425

 

You must to post a comment.
Last modified
07:47, 20 Jul 2017

Tags

This page has no custom tags.

Classifications

This page has no classifications.

Article ID

ID: 1167

Contact Support

Most questions can be answered by reviewing our documentation, but if you need more help, Cisco Meraki Support is ready to work with you.

Open a Case