This is our old Q&A Site. Please post any new questions and answers at


We have two production sites with 8 switches each. We have been experiencing some packet loss between servers and this can be quite time-consuming to troubleshoot. Currently, we have to go to site and mirror traffic from one switch at a time.

I would like to setup a server in each site with 8 network interfaces conneted to all switches. The plan is to mirror traffic from all switches to the Wireshark server and compare the traces to find the problem.

Can Wireshark correlate packet captures between multiple switches? How would I go about to set this up?

asked 02 Jul '16, 04:32

tempus's gravatar image

accept rate: 0%


Sounds tricky. Can't RSPAN help here?

(02 Jul '16, 15:57) Jaap ♦

RSPAN could be used to reduce the number of physical ports required on the server. This would only means that Wireshark would see traffic from multiple switches aggregated on the same interface. Sometimes it's nice to use RSPAN, but when troubleshooting packet loss it's usually best not to tunnel your packet captures over multiple hops.

(02 Jul '16, 16:21) tempus

First there is capacity planning. Having all traffic coming back to a single point the capture engine (and packet filter for that matter) will have a lot of work to do.

Then there is fault finding, or non-duplicate packet finding in this case. While Wireshark and tools are equipped to remove duplications, you are looking for them and where they are missing, just the opposite. Maybe MATE can help you out, but I'm not sure.

Still, in matters of packet loss, wouldn't the interface performance counters tell you what you seek?

(03 Jul '16, 01:22) Jaap ♦

Thanks for your answer. I'll look into what I can do with MATE. Perhaps if I can find a way to do a 'diff' between the captures of multiple interfaces.

I think I can get around the capacity problem by not mirroring from all switches (maybe only 2 or 3) at the same time. I can use capture filters with IP to only get the relevant packets.

Checking interface counters is usually the first step in the troubleshooting process, but interface counters are not always reliable in my experience.

(03 Jul '16, 03:29) tempus

To match the packets you could use the Multi Segment Analysis feature of Riverbed Packet Analyzer (I think an eval version is available) or the Match feature of TribeLab Workbench Community Edition.

(03 Jul '16, 07:39) PaulOfford
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 02 Jul '16, 04:32

question was seen: 2,063 times

last updated: 03 Jul '16, 07:39

p​o​w​e​r​e​d by O​S​Q​A