Cisco Cisco WAP551 Wireless-N Single Radio Selectable Band Access Point 관리 매뉴얼
Administration
Packet Capture
Cisco Small Business WAP551 and WAP561 Wireless-N Access Point
59
3
802.11 traffic
-- rpcap://[192.168.1.220]:2002/radio1
At WAP321561, VAP1 ~ VAP7 traffic
-- rpcap://[ 192.168.1.220]:2002/wlan0vap1 ~ wlan0vap7
At WAP321561, VAP1 ~ VAP3 traffic
-- rpcap://[ 192.168.1.220]:2002/wlan0vap1 ~ wlan0vap3
-- rpcap://[192.168.1.220]:2002/radio1
At WAP321561, VAP1 ~ VAP7 traffic
-- rpcap://[ 192.168.1.220]:2002/wlan0vap1 ~ wlan0vap7
At WAP321561, VAP1 ~ VAP3 traffic
-- rpcap://[ 192.168.1.220]:2002/wlan0vap1 ~ wlan0vap3
You can trace up to four interfaces on the WAP device at the same time. However, you must
start a separate Wireshark session for each interface. To initiate additional remote capture
sessions, repeat the Wireshark configuration steps; no configuration needs to be done on the
WAP device.
start a separate Wireshark session for each interface. To initiate additional remote capture
sessions, repeat the Wireshark configuration steps; no configuration needs to be done on the
WAP device.
NOTE
The system uses four consecutive port numbers, starting with the configured port for the remote
packet capture sessions. Verify that you have four consecutive port numbers available. We
recommend that if you do not use the default port, use a port number greater than 1024.
packet capture sessions. Verify that you have four consecutive port numbers available. We
recommend that if you do not use the default port, use a port number greater than 1024.
When you are capturing traffic on the radio interface, you can disable beacon capture, but
other 802.11 control frames are still sent to Wireshark. You can set up a display filter to show
only:
other 802.11 control frames are still sent to Wireshark. You can set up a display filter to show
only:
•
Data frames in the trace
•
Traffic on specific Basic Service Set IDs (BSSIDs)
•
Traffic between two clients
Some examples of useful display filters are:
•
Exclude beacons and ACK/RTS/CTS frames:
!(wlan.fc.type_subtype == 8 | | wlan.fc.type == 1)
•
Data frames only:
wlan.fc.type == 2
•
Traffic on a specific BSSID:
wlan.bssid == 00:02:bc:00:17:d0
•
All traffic to and from a specific client:
wlan.addr == 00:00:e8:4e:5f:8e
In remote capture mode, traffic is sent to the computer running Wireshark through one of the
network interfaces. Depending on the location of the Wireshark tool, the traffic can be sent on
an Ethernet interface or one of the radios. To avoid a traffic flood caused by tracing the
packets, the WAP device automatically installs a capture filter to filter out all packets destined
to the Wireshark application. For example, if the Wireshark IP port is configured to be 58000,
then this capture filter is automatically installed on the WAP device:
network interfaces. Depending on the location of the Wireshark tool, the traffic can be sent on
an Ethernet interface or one of the radios. To avoid a traffic flood caused by tracing the
packets, the WAP device automatically installs a capture filter to filter out all packets destined
to the Wireshark application. For example, if the Wireshark IP port is configured to be 58000,
then this capture filter is automatically installed on the WAP device: