I've enabled the Port Mirroring option on a Mitel 5312 phone, assuming it will send all packets at the network interface to the PC interface. I would then capture using Wireshark on my PC.
Unfortunately, Wireshark isn't capturing any new traffic after I enable mirroring. I only get the usual traffic to/from my PC's address, and broadcast/multicast traffic. I don't see any unicast traffic to/from the phone.
I'm curious whether this is a side-effect of our network config. We use Cisco Catalyst 2960-X switches, with default VLAN 1 and voice VLAN 9. Ports are configured with "switchport voice vlan 9", so the phones are identified by the switch and placed on VLAN 9 -- but the PC connected through the phone is on VLAN 1.
My hypothesis is that phone data is using 802.1q-tagged packets, which my PC NIC is ignoring. Normally my Intel NIC can support VLAN tagging, but the driver is currently broken by the latest Win10 release, so I can't just try it out.
Or could there be something else I'm doing wrong?