Cisco Cisco WAP571E Wireless-AC N Premium Dual Radio Outdoor Access Point Manual De Mantenimiento

Packet Capture

Cisco Small Business WAP551 and WAP561 Wireless-N Access Point

49

-- rpcap://[192.168.1.220]:2002/wlan0
802.11 traffic
-- rpcap://[192.168.1.220]:2002/radio1
At WAP561, VAP1 ~ VAP7 traffic
-- rpcap://[ 192.168.1.220]:2002/wlan0vap1 ~ wlan0vap7
At WAP561, VAP1 ~ VAP3 traffic
-- rpcap://[ 192.168.1.220]:2002/wlan0vap1 ~ wlan0vap3

You can trace up to four interfaces on the WAP device at the same time. However, 
you must start a separate Wireshark session for each interface. To initiate 
additional remote capture sessions, repeat the Wireshark configuration steps; no 
configuration needs to be done on the WAP device.

The system uses four consecutive port numbers, starting with the configured port 
for the remote packet capture sessions. Verify that you have four consecutive port 
numbers available. We recommend that if you do not use the default port, use a port 
number greater than 1024. 

When you are capturing traffic on the radio interface, you can disable beacon 
capture, but other 802.11 control frames are still sent to Wireshark. You can set up 
a display filter to show only:

•

Data frames in the trace

•

Traffic on specific Basic Service Set IDs (BSSIDs)

•

Traffic between two clients

Some examples of useful display filters are:

•

Exclude beacons and ACK/RTS/CTS frames:

!(wlan.fc.type_subtype  ==  8 | | wlan.fc.type == 1)

•

Data frames only: 

wlan.fc.type == 2

•

Traffic on a specific BSSID:

wlan.bssid ==  00:02:bc:00:17:d0

•

All traffic to and from a specific client:

wlan.addr == 00:00:e8:4e:5f:8e