This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

hi, I am trying to capture the data on a port-channel connected to a wireless controller so I can see what traffic is going to and from the wireless controller from the access point and wifi client.

I am not see this traffic and only seeing some of the other traffic, for instance, I see the RDP replies\ack but not the data.

Any help would be great. I am running wireshark on a windows machine.

Mikey

asked 24 Oct '17, 08:27

MikeyConway's gravatar image

MikeyConway
6112
accept rate: 0%

Can you elaborate on your capture setup? Are you using port mirroring, a tap, what is the line speed of the port-channel and of your capturing card, ...

(25 Oct '17, 11:05) sindy

Hi, I am spanning an 8-port port channel but I resolved the issue The issues is with the MacAfee HIPS services, once that was stopped the traffic was seen correctly.

Thanks for your response.

permanent link

answered 26 Oct '17, 00:15

MikeyConway's gravatar image

MikeyConway
6112
accept rate: 0%

Glad to hear that, however even if it is just 8×FE, you'd need to capture 1.6 Gbit/s at peak, so it won't fit to a single SPAN port even if it would be a GE one. Leaving alone 8×GE where you'd need to deal with 16 Gbit/s at peak which no PC is likely to manage regardless what network card you'd plug in.

(26 Oct '17, 00:22) sindy
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×139
×7
×1

question asked: 24 Oct '17, 08:27

question was seen: 504 times

last updated: 26 Oct '17, 00:22

p​o​w​e​r​e​d by O​S​Q​A