The color of the filter bar lets you know if you're on the right track: green - your filter syntax is correct yellow - proceed with caution you might get some unexpected results red - something is not right, it might be wrong syntax or wrong input, no results will be presented. All Wireshark filters are case sensitive - lowercase. If you're troubleshooting an issue, feel free to reach out to Meraki Support, who can help you understand what you might be seeing in the captures.īefore getting started, there are some things that will help when filtering with Wireshark. This guide can only scratch the surface of what can be done with Wireshark. If this is a concern, then it is recommended that you use a port mirror on the switch or use a network tap to capture data. The device is going to give higher priority to delivering the packets than capturing them. Keep in mind that captures from Meraki equipment aren't always going to display 100% of the packets that pass the device. Many times Wireshark can show the server admin that it is, in fact, NOT a network issue, but an issue where the server simply isn't responding to traffic that it's being sent.

This guide is going to be diving into some (but not all) moderate to advanced Wireshark filters that can be used to help troubleshoot and narrow down the issue.

For a quick rundown of how to get started, refer to the articles below. Meraki provides ample opportunity to gather data through packet capture. Network troubleshooting can be difficult and time-consuming to narrow down issues as they come up, and at some point, everyone will blame the network. One of the best tools that you can utilize is Wireshark, a free and open-source program.

Detecting wireshark usage