Under 'Value' put 'the same UDP port number as configured on the switch' >Īs an example: we are trying to capture ICMP (ping) packets going in and out of port 1 on the switch.

Once the traffic starts to arrive to the remote PC/Analyzer, we need to apply the following filter on Wireshark to view and analyze the traffic :Īnalyze > Decode As > + > Under 'Field' choose 'UDP' > Next, create a mirroring policy to capture the traffic as intended or simply mirror traffic from one port if that is the need. Remote Mirroring uses the Ip address of PC/Analyzer as the remote mirroring UDP encapsulation destination ip address (instead of a remote switch), and you choose any UDP port number between Īdvantage: This makes taking captures quite easy and convenient without the need for the PC/Analyzer to be connected physically to a local or remote switch. This can be achieved by using the functionality of remote mirroring on the Aruba OS switch. So the question is: How do we capture traffic from an Aruba OS switch and analyze it without the need for the PC/Analyzer machine to be connected to a remote/local switch ? The Analyzer might be connected wirelessly to an Access Point or arrive via a VPN and then connect to the switch. However we might not have the analyzer directly connected to the switch or even to a remote switch. We often find a need to capture traffic in and out of our switch ports.

Wireshark capture remote machine