This is unacceptable.

[RaphaelL]

Hi ,

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Packet_Capture_Overvi... ( this will be updated )

Read-only and monitor-only are able to perform disruptive actions ( without any logs 😍 ) such as Cable-tests and port cycles.

And now it's getting worse. These roles are now able to perform packet captures on your switches. Does that make any sense ? Absolutly not.

Who thought that this was a good idea ..?

I feel like Meraki isn't taking security seriously.

[rhbirkelund]

Where do you see that read-only and monitor-only users can do pcaps?

[RaphaelL]

I haven't tested all the ways to do it but this is one of them : 

Might also be accessible with the new UI from Intelligent packet capture

[rhbirkelund]

I think I remember that it is a bug. There was another thread about it some weeks ago. The doc also explicably says that it’s not present for read- and monitor-only users.

[RaphaelL]

Confirmed by support this is not a bug. The doc as mentionned will be modified.

I have been advised by our development team the feature of packet capture is available in switch port page for Read-only user as by desgin in a new dashboard UI version. 

Our KB Packet Capture Overview will be updated accordingly.

[BHC_RESORTS]

I agree that cable testing and port cycle is not a read-only function as it is doing something, but packet capturing is a read-only function. Granular security would be nice, but it's still a passive/read only operation.

[cmr]

I actually think there needs to be three levels.

manage

operate

view

I have several users who I want to be able to run cable tests, bounce ports, take packet captures etc. but not change things so with the current admin and read only, I'm happy for them to have the role.  I wouldn't give someone access at all if I was worried about them bouncing ports for fun.

[RaphaelL]

This ^ 

I have around 400 users. Most of them are 100% clueless about networking. They only want to see the status of the switch ports ,  view the usage and so on. I don't want them to do packet captures, port cycles. Hell no.