How to capture packets using Wireshark on SMB router or switch
Packets capture and analysis are very important for us to troubleshoot when some problems occur such as the router can’t obtain IP from ISP, the client can’t receive multicast packets, etc. This document will introduce how to capture packets using Wireshark in SMB router or switch.
- Wireshark Software
Wireshark is available at https://www.wireshark.org. It’s a free and powerful sniffing and analyzing software.
- PC with Ethernet port
Typical Packet Capturing Topology
Note: Connect PC to SMB router or switch directly.
- Download and install Wireshark on your PC.
- Connect PC to the SMB router or switch directly.
- Set Port Mirror for PC and the port you want to capture packets.
- SMB router
Input the IP address to the address bar in the web browser and you will visit the GUI of the SMB router.
After logging into the page, go to Network-Switch-Mirror, enable Port Mirror, select the port connecting to your PC in the Mirroring Port and the port you want to capture packets in the Mirrored Port, click Save.
- SMB switch
Input the IP address to the address bar in the web browser and you will visit the GUI of the SMB switch.
After logging into the page, go to MAINTENANCE-Mirroring, click Edit, select the port connecting to your PC in Destination Port Config and enable Ingress and Egress option in the port you want to capture packets in Source Interface Config, click Apply.
- Run Wireshark, select the interface you connect to SMB router or switch.
Apply the display filter
Since the router/switch is forwarding packets constantly, we may need to apply some display filter to filter out the packets we are interested in.
IP address: ip.addr==192.168.0.1, 188.8.131.52, etc.
UDP port: udp.port==29810, 4500, etc.
TCP port: tcp.port==443, 53, etc.
Protocol: IGMP, DHCP, ISAKMP, etc.
Is this faq useful?
Your feedback helps improve this site.
Still need help? Search for answers, ask questions, and get help from TP-Link experts and other users around the world.