Ask Your Question

How do I capture on a mirrored switch port?

asked 2021-06-10 06:28:17 +0000

updated 2021-06-10 23:27:51 +0000

Guy Harris gravatar image

I can't get my head around the way the data is presented on the mirror port. Do I need a second network card? How does Wireshark present the data? As you can see, I don't even know the right questions to ask! Thanks

edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2021-06-10 09:04:01 +0000

BigFatCat gravatar image

updated 2021-06-10 23:19:32 +0000

Switch can be configured to mirror ingress, egress, or both directions. Copying traffic for both directions to a single port can be a problem when the mirrored traffic is greater than the monitoring port interface speed. The monitoring port is the port where the engineer wants to send a copy of traffic to. Basically, the monitoring port interface has to large enough to support the traffic from the mirrored-port(s).

An example is mirroring port 1 (1G) to port 5 (1G). The maximum bandwidth needed is 2G because there is 1G ingress and 1G egress of traffic. This exceeds the port 5, 1G port speed, and the switch will drop some of the packets.

Another issue are microbursts.

Capturing with two network cards will work if the network cards can capture at port speed. There is an article in NetworkDataPedia by Tony Fortunato with a detail explanation.

Capturing with one or two network cards, the traffic is displayed the same. When you merge files, there isn't any way to tell what hardware was used to capture the packet because the PCAP packet header doesn't have a field to identify the capturing hardware. Most of the time this isn't an issue.

Sniffers have proprietary file format that can identify the port used to capture the packets.

edit flag offensive delete link more

answered 2021-06-10 07:18:04 +0000

I just found the Wiki page covering this ( ). I'm still unclear on a couple of things, but I'll start experimenting.

Apologies for the noise.

edit flag offensive delete link more


As noted at the top of the page, that's the old, un-maintained site. The maintained site is at Ethernet Capture.

grahamb gravatar imagegrahamb ( 2021-06-10 07:27:50 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-06-10 06:28:17 +0000

Seen: 77 times

Last updated: Jun 10