Tag Archives: packet capture

Cisco Switch Wireshark Packet Capture

One of the most fundamental troubleshooting concepts in all of IT is to capture packets and review the data as it flows over the wire. Historically the easiest way to do this was to configure some type of SPAN port on a switch to copy the traffic to your pack capture device. With today’s less expensive and more powerful hardware it should come as no surprise that this functionality is now available on network hardware it’s self. Continue reading

Posted in Networking | Tagged , , , , , | Leave a comment

Cisco Layer 2 Tunneling

To a student of networking the OSI model can be a little hard to appreciate until its application is actually seen a few times in the real world.  Likewise understanding that you can grab frames or packets and encapsulate them inside other higher layer protocols is also confusing to the newbie.  An Ethernet pseudo-wire is a great example of this.  Essentially, you can capture an entire Data Link layer frame as it enters an interface, encapsulate it, and deliver it out another interface no matter what type of network you have in between.  Cool stuff right?  Let’s dive in and … Continue reading

Posted in Networking | Tagged , , , , , | Leave a comment

Create ACL Rules with Wireshark

I stumbled onto this wireshark feature by accident really but thought I would share a little bit about it. Essentially what wireshark does is allows you to review all the captured packets and then a single packet in more detail. Continue reading

Posted in Networking, Security | Tagged , , , , | Leave a comment

Cisco Switch Remote SPAN

Capturing network traffic can be a very effective way of solving complicate issues particularly when log files are not yielding useful results. One issue typically is the ability to actually physically perform the capture. To overcome these limitations a Remote SPAN or RSPAN instance can be used. Continue reading

Posted in Networking | Tagged , , , , , , | Leave a comment