The fewer packets that are captured means that you can capture longer. However, the disadvantage can also be an advantage as you won't have too many frames to investigate and a lot of noise isn't going to be getting in your way. The disadvantage of excluding other traffic is that you might miss something that might be going on. The capture filter is going to only save traffic that you specify so don't be surprised if the resulting capture is empty. The general rule here is, the more simple the better. These are not to be confused with Display filters as they use a completely different syntax. This article is written based on this version.Ĭapture filters are what the dashboard is going to use to search for packets to download. Always remember to press enter after modifying the filter, without pressing enter the filter won't be activated.Īs of April 10, 2020, the current version of Wireshark is 3.2.3. The color of the filter bar lets you know if you're on the right track: green - your filter syntax is correct yellow - proceed with caution you might get some unexpected results red - something is not right, it might be wrong syntax or wrong input, no results will be presented. All Wireshark filters are case sensitive - lowercase. If you're troubleshooting an issue, feel free to reach out to Meraki Support, who can help you understand what you might be seeing in the captures.īefore getting started, there are some things that will help when filtering with Wireshark. This guide can only scratch the surface of what can be done with Wireshark. If this is a concern, then it is recommended that you use a port mirror on the switch or use a network tap to capture data. The device is going to give higher priority to delivering the packets than capturing them. Keep in mind that captures from Meraki equipment aren't always going to display 100% of the packets that pass the device.

Many times Wireshark can show the server admin that it is, in fact, NOT a network issue, but an issue where the server simply isn't responding to traffic that it's being sent. This guide is going to be diving into some (but not all) moderate to advanced Wireshark filters that can be used to help troubleshoot and narrow down the issue. For a quick rundown of how to get started, refer to the articles below.

Meraki provides ample opportunity to gather data through packet capture. Network troubleshooting can be difficult and time-consuming to narrow down issues as they come up, and at some point, everyone will blame the network. One of the best tools that you can utilize is Wireshark, a free and open-source program.

What is wireshark and how does it work