Hi all. I need to capture all EAPOL traffic happening on one specific switch. Therefore I set up what follows.
- configured a mirror port (SPAN) on the switch.
- attached a notebook to this mirror port.
- started Wireshark 3.0.6 on this notebook and selected the Ethernet NIC
- on the switch I configured the mirror so that all switch ports (except for the uplinks and the one port where the Wireshark notebook is connected to) will mirror the traffic to the designated "mirror port"
- on Wireshark again, I set the capture filter to be "ether proto 0x888e" but it did not capture anything.
So, please: is anybody able to help me in this? I've read some threads also and even there, some people were reporting that they weren't able to set a capture filter for EAPOL.
Thanks in advance! Flavio.