Either you run wireshark directly on the endpoint, or you setup some means of tapping into the traffic. The most common method is to use a managed switch to se

Either you run wireshark directly on the endpoint, or you setup some means of tapping into the traffic. The most common method is to use a managed switch to setup a mirror port. Basically you tell the switch to copy all traffic and send it out on an extra port and then capture traffic while connected to that port.