NetApp built-in packet capture | VirtuallyMikeBrown - http://virtuallymikebrown.com/2013...
They way I use this, as you might expect, is to start the capture, perform the operation that’s failing, and then stop the capture.  So as not to capture too much traffic and therefore have to wade through all of it, I try to perform those steps rather quickly.  But then again, if you know a few useful features of Wireshark, you can get around in the capture file pretty easily. - Matteo Marchelli