The challenge I often have for capturing packets is that I need 2 interfaces on the machine doing the capture. It has been problematic to use the wired NIC on the span port and using the wireless NIC for remote access to the laptop. I am tempted to do the following: - setup the span port on the interface where the only wired NIC of the laptop is attached. But don't enable it yet. - remote control and setup wireshark to capture from the wired NIC. Start the capture. - enable the span port on the switch. This will prevent remote access to the laptop during the capture. - when ready, disable the span config on the NIC. - remote control to the laptop and stop the capture. The advantage is I could use whatever machine is available instead of having to get a local person to setup a laptop and (try to) tell me what the wireless IP address is.