Normally (if there is a "normal" in fire attack) a major incident will "grow" from a smaller incident. That smaller incident will already have a ground tactical and air tactical frequency assigned. When you hear those orders for a command net, and strike teams and more tankers and such - time to stop everything and listen carefully. They will assign frequencies quickly over the air and most likely, that will be the last time you hear them mention those frequencies to the dispatch because afterwards they include the frequencies in the Incident Action Plans. Afterwards, it's pretty hard to find the tacticals that go with the incident just by searching. IC might request a command net and two additional tact frequencies. ECC will then report back "utilize Tact 5 and 9". That's it! Write those down, (don't plug them in yet because more are coming. Until you're sure ECC is done or you have two scanners, then you can busy your radio with programming.)
ECC should come back with the command frequency and tone and probably some additional air frequencies - usually in the AM band between 118-138Mhz - called "Victor Frequencies". Now that you heard all that, then plug them in and start listening. Put the Command frequency in the priority instead of the dispatch frequency. The purpose of the Command freq is to have a direct admin line between the incident and the ECC, relieving the dispatch frequency for normal traffic (a.k.a Medical Aids). Plug the tactical traffic in with delays and the air net freqs also with delays. Then sit back and enjoy the traffic. If you still want to monitor local net, see if you can get it on another radio at a lower volume. You don't want to tie up the major incident with local net traffic.
The Incident Command System (ICS) now comes into play with radio traffic and affects the traffic you'll hear. If you're not familiar with Incident Command System, go read about that and come back here. All the administrative and operations traffic go over Command frequencies. The Incident Commander is usually in an Incident Command Post by this time making decisions based on field reports, weather and maps.