I have a managed switch that has the capability (port mirroring) described by @Water_my_lawn. I recently used this capability to find a problem where a device (not OS) would drop off the network occasionally.
I mirrored the port with the ‘bad’ device to another port. I plugged a PC into the mirror port and ran WireShark. As expected the mirrored port receives more than just packets with the device IP as the destination, most significantly broadcast packets and lots of them. After some experimentation I made a capture filter to remove most of the broadcast packet noise that was not likely to be creating the problem. In my case, the problem was caused by SNMP discovery broadcast packets that the ‘bad’ device did not handle correctly.
So, I think this method could be a good way to characterize the traffic on the OS port. E.g. Is the issue caused by a packet volume or a specific type of packet or something else?
My $.02
Dave