This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

capture on bundled port(4 port part of etherchannel)

0

Is it possible to capture on bundled ports accurately,capturing 4 gb on 1 bg interface looks not feasible but still how?

asked 05 Jul '13, 02:25

kishan%20pandey's gravatar image

kishan pandey
221282936
accept rate: 28%


One Answer:

0

It depends where you want to capture.

If you want to capture on a switch, you will have a hard time, because it does not make sense to mirror 4 ports to only one capturing port, as the capturing link can be flooded in case of massive traffic. You can however use a capturing system with 4 interfaces and mirror each of the aggregated (etherchannel) ports to one mirror/monitoring port.

If you want to capture on the system that is directly connected to the switch with four adapters (aggregated by the driver - sometimes called adapter teaming), you can try to capture on the aggregated virtual device that will be provided by the driver (run dumpcap -D -M to see that device). Alternatively you can capture on all 4 interfaces with a recent version of Wireshark, by specifying the option -i several times.

Regards
Kurt

answered 22 Jul '13, 15:38

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%