> For the complete documentation index, see [llms.txt](https://cisco.microcisco.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cisco.microcisco.com/icnd-1/wireshark-basics.md).

# Wireshark Basics

## Wireshark Capture

![](https://4011257951-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LtfmTuncdFr6DnNyt_b%2F-MDpm7SbuH_CBR9WIlpN%2F-MDq6ioml6liETcFKeyX%2Fimage.png?alt=media\&token=04a18e95-42ce-4c50-9116-c10593565e61)

![The frame here is not a L2 frame as we know it but rather the Physical Layer Metadata ](https://4011257951-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LtfmTuncdFr6DnNyt_b%2F-MDpm7SbuH_CBR9WIlpN%2F-MDq3xx5H_t7MFOyf2Tv%2Fimage.png?alt=media\&token=f86d4292-4de4-4369-a33d-738c17b15865)

The Ethernet II is the LAYER 2 **FRAME**\
The Internet Protocol v4 is the LAYER 3 NETWORK **PACKET**\
The Transmission Control Protocol (TCP) is teh LAYER 4 **SEGMENT**

### Port SPAN - Mirroring

If we check for http traffic between SW1 and R1 there will be none as web traffic is generated between PC1 and the Web Server so no traffic will be observed (in this test case). If we wanted to capture traffic thats not being tranversed where the captue is occuring , we will have to span (**switch port analyse**r) or mirror the port on a switch so that we can mirrior traffic on one port onto another

![](https://4011257951-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LtfmTuncdFr6DnNyt_b%2F-MDpm7SbuH_CBR9WIlpN%2F-MDqC7lDluAczL_vNpGB%2Fimage.png?alt=media\&token=c3934b48-586b-410d-98ea-9190977a73cd)

To configure the mirroring use 'monitor'

`S1(config)#monitor session 1 source interface gi0/0` \
`S1(config)#monitor session 1 destination interface gi0/3`\
`S1# show monitor session 1`