Depending on the location of the Wireshark tool, the traffic can be sent on an Ethernet interface or one of the radios. In remote capture mode, traffic is sent to the computer running Wireshark through one of the network interfaces. !(wlan.fc.type_subtype = 8 | | wlan.fc.type = 1)Īll traffic to and from a specific client: Some examples of useful display filters are: Traffic on specific Basic Service Set IDs (BSSIDs). You can set up a display filter to show only: When you are capturing traffic on the radio interface, you can disable beacon capture, but other 802.11 control frames are still sent to Wireshark. We recommend that if you do not use the default port use a port number greater than 1024. Verify that you have four consecutive port numbers available. The system uses four consecutive port numbers, starting with the configured port for the remote packet capture sessions. No configuration required on the WAP device. To initiate additional remote capture sessions, repeat the Wireshark configuration steps. However, you must start a separate Wireshark session for each interface. You can trace up to four interfaces on the WAP device simultaneously. The interface can be one of the following: Linux bridge interface in the wap device -rpcap://:2002/brtrunk Wired LAN interface - rpcap://:2002/eth0 VAP0 traffic on radio 1 - rpcap://:2002/wlan0 802.11 traffic - rpcap://:2002/radio1 At WAP361, VAP1 ~ VAP7 traffic - rpcap://:2002/wlan0vap1 ~ wlan0vap7 At WAP150, VAP1 ~ VAP3 traffic - rpcap://:2002/wlan0vap1 ~ wlan0vap3 At the Wireshark popup window, next to the IP address, there is a drop-down menu to select the interfaces. Select the interface from which you need to capture the packets. For example, enter 2002 if you used the default, or enter the port number if you used a port other than the default. In the Port field, enter the port number of the WAP device. In the Host field, enter the IP address of the WAP device.
On your computer, initiate the Wireshark tool.
0 kommentar(er)
