On May 6, 2021, at 20:16, alex <firstname.lastname@example.org> wrote:Well, to get the Mac to even see the packets between the Eagle and CP4, you'll first need to configure the switch to mirror the traffic on the Eagle's and CP4's port on the switch to the port that the Mac is plugged into. I'm sure the unifi controller will let you do this (I use Unifi gear as well, but only for wireless APs, so I don't know what the control pane for their switches looks like.) The Eagle just runs a Windows OS, you can at least try running Wireshark on it to see how it goes before having to go through the rigamarole of setting up port mirroring for a third host.
But whichever way you get it set up, you'll want to get the MAC addresses of the Eagle and the CP4. You can quickly get the CP4's MAC address by looking at the arp cache on the Ealge. You can do this by popping open a Powershell window and running:
This will print out the Eagle's view of the network's IP-MAC Address mapping. If you don't see your Eagle in there, ping it first then run the arp command again, and it should then show up. The Eagle's own MAC address won't show up in this output. To get that, you can run the following from a Powershell prompt:
Just find the ethernet interface you're interested in and note its MAC address, which is specified in the Physical Address field.
Once you have the CP4 and Eagle's MAC addresses, you can run Wireshark and use the following display filter:
eth.addr==aa-aa-aa-aa-aa-aa and eth.addr==bb-bb-bb-bb-bb-bb
aa-aa-aa... and bb-bb-bb... are the MAC addresses of your Eagle and CP4. It's just a boolean filter, so which order they are specified in doesn't matter. Do note that is a double equal sign, per the norm for boolean notation.
At that point, you start going about your normal work and wait. When/If the freeze-up happens, you can save the capture by Ctrl-A'ing all the packets in the display area and going to File > Export Specified Packets. Save it as the default pcapng format and then someone can do something with that info.