Cisco Cisco WAP351 Wireless-N Dual Radio Access Point with 5-Port Switch Manual De Mantenimiento

Packet Capture

Cisco WAP131 and WAP351 Administration Guide

62

tool. When capturing 802.11 traffic, a large portion of the captured frames tends to 
be beacons (typically sent every 100 ms by all access points). Although Wireshark 
supports a display filter for beacon frames, it does not support a capture filter to 
prevent the WAP device from forwarding the captured beacon packets to the 
Wireshark tool. To reduce the performance impact of capturing the 802.11 
beacons, disable the capture beacons mode.

The Packet Capture Status area shows the status of a packet capture, if one is 
active on the WAP device. 

•

Current Capture Status—Whether the packet capture is running or 
stopped.

•

Packet Capture Time—The elapsed capture time.

•

Packet Capture File Size—The Local File capture file size; cannot record 
Remote capture file size.

Click Refresh to show the latest data from the WAP device, or click Stop Capture 
to stop a packet file capture.

You can download a capture file by TFTP to a configured TFTP server, or by 
HTTP/HTTPS to a computer. A capture is automatically stopped when the capture 
file download command is triggered.

Because the capture file is located in the RAM file system, it disappears if the WAP 
device is reset.

To download a packet capture file using TFTP:

Select Administration > Packet Capture.

Check Use TFTP to download the capture file.

Enter the TFTP Server Filename to download if it is different from the default. By 
default, the captured packets are stored in the folder file /tmp/apcapture.pcap on 
the WAP device.

Specify a TFTP Server IPv4 Address in the field provided.