Summary:
This article provides information on how to use a snoop filter, which is configured on an AP, to collect wireless packet captures.
Symptoms:
- Advanced troubleshooting usually involves low-level debugging at the packet level.
- In a Windows environment, you will be unable to directly capture packets with a wireless NIC, due to the driver limitations.
Solution:
- Identify the AP that needed to be monitored and an AP to sniff the wireless traffic.
Note: These two APs have to operate on the same channel and be in the same coverage area.
- Configure the AP, which is used for sniffing, in the sentry mode:
Make sure that the AP being used for sniffing is configured in the sentry mode, so that you do not add interference. In normal circumstances, 2 APs in close proximity, which are operating on the same channel, are interfering. But when an AP is operating in sentry mode, it will listen for traffic only on the specified channel, rather than broadcasting traffic.
To configure an AP to operate in the sentry mode, use the following command: set ap <x> radio <y> mode sentry
- Configure the snoop observer:
This is a wired machine that has Wireshark installed on it and a L3 connection with the sniffing AP.
set snoop observer <ip address of the observer, on which Wireshark is installed> transmission-mode tzsp
- Configure the snoop filter:
set snoop filter test channel eq <operating channel of the test APs> observer <ip address of the observer> set snoop filter test mode enable
- Apply the snoop filter to the sniffing AP:
set ap <ap number of AP used for sniffing> radio <x> snoop test
- Start a capture in Wireshark:
Start a capture in Wireshark on the Ethernet interface, which holds the connection with the sniffing AP, and do not forget to select the Capture packets in promiscuous mode option.
Note:
The above procedure does not have the necessary resolution to capture large amounts of traffic; but to inspect specific packets (association requests, beacons, and so on). To capture large amounts of traffic, refer to the following articles: