Packet Capture on a Mirrored Port?

[Bassman]

We have a MS425 Merkai switch and mirror traffic from 3 ports to port 14.  Port 14 is then connected to security appliance to analyse for any security breaches etc.

I would like to use the option within the Meraki console to run a packet capture on Port 14, but when I do there is no data captured.  This must be something to do with the port being configured as a mirrored ports as it works on all other ports.  When I do run a packet capture on Port 14, the only output that I get is:-

--- Start Of Stream ---
reading from file /tmp/click_pcap_dump, link-type EN10MB (Ethernet)
--- End Of Stream ---

I assume that this is normal and I cannot capture port traffic on the mirrored port by using the Meraki console?

Thanks.

[PhilipDAth]

Hmm, that doesn't surprise me.  Can you do a capture on port 3?  I'm guessing that won't work either (or worse, might break the mirror session).

[Adam]

So two suggestions on this:

1.  Have you tried doing a capture to a pcap file instead of to the display to see if it makes any difference?  Are you seeing the traffic on the device connected to that mirror destination port?

2.  I had a similar issue to this with one of our Meraki switches where I couldn't see the mirror traffic in a capture either because the ports weren't in the same asic (maybe wrong terminology there).  I can't remember how many ports are grouped together in an asic (maybe 16) but basically, I had to make sure the source and destination ports were in the same asic for it to work properly. 

[Bassman]

Thanks for the response. No, that doesn't work either. I connected a PC running wire shark directly to the mirrored port for testing and can see that the port is indeed mirroring data, just the data capture does not work. This is for both and on-screen and to a file capture.