Wireshark-users: Re: [Wireshark-users] Using wireShark on teamed Network card

From: Steve Bertrand <steve@xxxxxxxxxx>
Date: Wed, 23 Dec 2009 10:18:03 -0500
Tal Bar-Or wrote:
> 
> Hello,
> 
> i would like to know if there any best practice for capturing teamed
> IEEE 802.3 dynamic link aggregation , is it right way to capture the
> teamed unified nic or other way, other than that if i would decide to
> capture via port-span that teamed nic what would be the best
> way/settings to do it on switch configuration from span ports point of
> view in assumption i used Cicso switch.

What type of Cisco switch? On a 2950:

(config)#monitor session 1 source interface ?

  FastEthernet  FastEthernet IEEE 802.3
  Port-channel  Ethernet Channel of interfaces

(config)#monitor session 1 destination interface ?

  FastEthernet  FastEthernet IEEE 802.3

...just select which etherchannel you want to monitor, and set your
monitor port as the destination.

It appears as though with 2924 and 3548, you must put the monitor port
into access mode within the VLAN that the etherchannel is in, and
configure the monitoring in interface config context. So, if I have
gi0/1 and gi0/2 in an etherchannel configured to trunk over vlan 762 and
want to use port fa0/35 as my mirror port:

(config-if)#switchport access vlan 762
(config-if)#port monitor vlan 762

Steve