SPAN ports are passive and can be configured without service interruptions, which makes them the ideal choice for engineers who need a quick packet capture in a high availability environment. This method copies traffic from one or many switch ports over to a port where the capture tool is connected, allowing it access to packets to and from a target device or server. There are two common ways that network engineers get around this gap invisibility. If we plug into an adjacent port on the switch, we will only be able to capture broadcast, multicast, our own unicast, and flooded traffic (packets where the switch does not know the destination port). Only the device directly attached to the switch will “see” the network traffic for that port. These days, however, switches now isolate these domains to a single interface. Ethernet hubs gave us direct access to the collision domain. In the old days, we could just walk up to a hub, find an open port, and click capture on the analysis tool. Switches can make packet capture difficult.
#Ubnt packet capture tool help how to
Let’s take a quick look at how to get into the path of packets in a switched network. This is easier said than done in modern networks. If we are not capturing in the right place and in the right way, we can completely miss a network event and lose out on the packet truth that would lead to problem resolution. However, we first need to get past that first step – properly placing the capture device along the network path.
When a device is placed properly in the network path, it can keep up with the ingress packet stream, and the protocol under capture is playing by the rules, the collected packet data is the gold standard for network visibility and troubleshooting. Network engineers have heard that statement for years.