So I have a large network for a wisp and I have customers using nat out to the internet but one of the nat addresses has been blick listed and I need to packet capture to find exactly where it's comming from. I was going to use my egderouter and mirror the incoming port then use wireshark but i'm getting way too many packets wireshark, the router and my computer are freaking out. So what i'm needing is to find a way to only mirror an ip addres range because I know what location it's coming from. Idk if some kind of firewall would help to do this. Also if there's something better then wireshark then I can try that too.
thanks
