Remote Packet Trace - HP 501 Configuration And Administration Manual

3. Specify the following parameters:
If you change either of these values, you must click Save before initiating a trace.
4. Click Start Trace.
The trace session runs for the specified duration. You can view the trace status in the File
trace status section. Click Refresh to see updated trace time and file size values. You
can click Stop Trace to stop a trace before the specified duration has elapsed.

Remote packet trace

Remote packet trace enables you to specify a remote port as the destination for packet
captures. This feature works in conjunction with the Wireshark network analyzer tool for
Windows. A packet trace server runs on the HP 501 and sends the captured packets via a TCP
connection to the Wireshark tool.
Note
When MAC cloning is enabled, remote packet trace does not work for remote wireless clients.
When the remote trace mode is in use, the HP 501 does not store any captured data locally in
its file system.
Note
Remote packet trace is not standard on the Linux version of Wireshark. The Linux version does
not work with the HP 501.
Setting up Wireshark sessions
You can trace up to five interfaces on the HP 501 at the same time. However, you must start a
separate Wireshark session for each interface. You can configure the IP port number used for
connecting Wireshark to the HP 501. The default port number is 2002. The system uses five
consecutive port numbers starting with the configured port for the packet trace sessions.
If a firewall is installed between the Wireshark PC and the HP 501, these ports must be allowed
to pass through the firewall. The firewall must also be configured to allow the Wireshark PC to
initiate TCP connection to the HP 501.
After you start remote trace on the HP 501, you can configure Wireshark to use the HP 501 as
the source for captured packets. To do this, you must specify the remote interface in the
Capture Options menu. For example, to trace packets on an HP 501 with IP address
192.168.1.10 on the radio interface using the default IP port, specify the following interface:
rpcap://192.168.1.10/radio1
To trace packets on the Ethernet interface of the HP 501 and on the radio interface using IP
port 58000, start two Wireshark sessions and specify the following interfaces:
rpcap://192.168.1.10:58000/eth0
rpcap://192.168.1.10:58000/radio1
•
Trace duration: The time duration in seconds for the trace (range 10 to 3600).
•
Max trace file size: The maximum allowed size for the trace file in KB (range 64 to
4096).
Network trace configuration 57