How to Capture Packets Using Port Mirroring on MS

Port mirror egress modes 

Meraki switches offer two egress modes for port mirrors: 

• True egress — Native VLAN traffic is untagged. 

• Tagged egress — Native VLAN is tagged. 

The following switches support each mode: 

• True egress: MS22, MS42, MS120, MS220, MS320, MS350, MS390, MS410, Meraki managed and monitored Catalyst switches. 

• Tagged egress: MS225, MS250, MS420, MS425. 

Capture filter types 

You can filter a capture for a specific client's IP address or for a specific type of traffic. Filter either before or after the capture. The filters used for each differ. 

• Capture filter — Limits the type of data the switch captures and saves to the file. This filter is used less frequently. Its syntax differs from display filters. Refer to the Wireshark database for capture filter syntax. 

• Display filter — The more common filter type. It does not reduce the traffic captured, which eliminates the possibility of applying an incorrect filter and missing the traffic required to troubleshoot. Apply this filter inside Wireshark when viewing the completed capture. Refer to the Wireshark database for display filter syntax. 

Understanding a rolling capture 

A rolling capture automatically saves the output to files at set intervals and breaks up a large capture into multiple smaller files. This helps when running a long-term capture for troubleshooting intermittent issues such as choppy audio on VOIP. 

For some issues, you may need to run port mirrors or span port captures for long periods until the issue occurs. The goal is to run a capture and stop it once the issue surfaces. A capture run for a long duration—6 hours, for example—produces a .pcap file too large for your computer to open, since captures larger than 100 MB become difficult to open on some computers. Configure the capture with multiple options to make this easier. 

Understanding the ring buffer 

Set ring buffers to ensure you do not fill up all the disk space on your device. The ring buffer starts overwriting the oldest file based on how many files you specify. You do not have to use it, but it helps ensure you do not fill up your HDD. 

Enable port mirroring on your switch 

Mirror one or more ports on an MS switch: 

1. In the Meraki dashboard, navigate to Switch > Monitor > Switch port    s. 

2. Select one or more ports to be mirrored. You can mirror multiple source ports to a single destination port. 

3. Select Mirror. 

4. Specify the destination mirror port, which captures traffic on the source ports. Both ports must be on the same switch or within the same switch stack. You can have multiple source ports but only a single destination port. 

5. Select Create port mirror. 

Connect a workstation to your destination port 

1. Physically connect a workstation to your destination port. 

2. Make sure DHCP is enabled on the host. 

3. Confirm the host receives a 169.254.X.X IP address. 

Clients connected to a destination port of a port mirror do not have network connectivity, as the destination port does not serve clients. 

Take a packet capture with Wireshark 

Wireshark displays the packets a device sees. Packets contain the data transmitted between computers, and viewing this information often aids in diagnosing network issues. A hardwired device may not see all packets transmitted on a network; it may only see broadcast packets and packets addressed to itself due to the functionality of modern networking equipment. 

1. Open Wireshark. 

2. Select Capture Options. 

3. Uncheck Enable promiscuous mode on all interfaces, check the Promiscuous option for your capture interface, and select the interface. 

4. Select Start. A new window shows the packets the device picks up. 

5. Select Stop once you obtain the desired packets.

6. Save the capture from the File menu with a distinct name. 

Take a rolling capture 

1. Open Wireshark. 

2. Select Capture Options. 

3. Uncheck Enable promiscuous mode on all interfaces, check the Promiscuous option for your capture interface, and select the interface. 

4. In the Output tab, select Browse. 

5. Enter a filename in the Save As field, select a folder to save captures to, and select Save. 

6. Select Create a new file automatically after… and Use a ring buffer with x files. This creates a maximum of x files, with each file set to the size or timeframe configured. For example, creating a new file automatically after 32 megabytes with a ring buffer of 128 files provides 4 gigabytes of rolling captures. 

7. Select Start. A new window shows the packets the device picks up. 

Apply a display filter 

1. Open your packet capture. 

2. Select the filter box. 

3. Input the filter string as provided by your support engineer, then select Apply. 

4. To save the filtered data, go to File > Export Specified Packets. 

5. Make sure the Displayed radio button is checked and the file has a unique filename, then select Save.