How Remote Traffic Monitoring Works; Using Snoop Filters On Radios That Use Active Scan; All Snooped Traffic Is Sent In The Clear - D-Link DWS-1008 - AirPremier MobileLAN Switch Product Manual

How Remote Traffic Monitoring Works

To monitor wireless traffic, an AP radio compares traffic sent or received on the radio to snoop filters
applied to the radio by the network administrator. When an 802.11 packet matches all conditions in a
filter, the AP encapsulates the packet in a Tazmen Sniffer Protocol (TZSP) packet and sends the packet
to the observer host IP addresses specified by the filter. TZSP uses UDP port 37008 for its transport.
(TZSP was created by Chris Waters of Network Chemistry.)
You can map up to eight snoop filters to a radio. A filter does not become active until you enable it.
Filters and their mappings are persistent and remain in the configuration following a restart. However,
filter state is not persistent. If the switch or the AP is restarted, the filter is disabled. To continue using
the filter, you must enable it again.

Using Snoop Filters on Radios That Use Active Scan

When active scan is enabled in a radio profile, the radios that use the profile actively scan other channels
in addition to the data channel that is currently in use.
Active scan operates on enabled radios and disabled radios. In fact, using a disabled radio as a dedicated
scanner provides better rogue detection because the radio can spend more time scanning on each
channel.
When a radio is scanning other channels, snoop filters that are active on the radio also snoop traffic on
the other channels. To prevent monitoring of data from other channels, use the channel option when you
configure the filter, to specify the channel on which you want to scan.

All Snooped Traffic Is Sent in the Clear

Traffic that matches a snoop filter is copied after it is decrypted. The decrypted (clear) version is sent
to the observer.
D-Link DWS-1008 User Manual