Best Practices For Remote Traffic Monitoring; Configuring A Snoop Filter - D-Link DWS-1008 - AirPremier MobileLAN Switch Product Manual

Best Practices for Remote Traffic Monitoring

• Do not specify an observer that is associated with the AP where the snoop filter is running.
This configuration causes an endless cycle of snoop traffic.
• If the snoop filter is running on a Distributed AP, and the AP used a DHCP server in its
local subnet to configure its IP information, and the AP did not receive a default router
(gateway) address as a result, the observer must also be in the same subnet. Without a
default router, the AP cannot find the observer.
• The AP that is running a snoop filter forwards snooped packets directly to the observer. This
is a one-way communication, from the AP to the observer. If the observer is not present,
the AP still sends the snoop packets, which use bandwidth. If the observer is present but is
not listening to TZSP traffic, the observer continuously sends ICMP error indications back
to the AP. These ICMP messages can affect network and AP performance.
To inform you of this condition, MSS generates a log message such as the following the first time an
ICMP error message is received following the start of a snoop filter:
AP Mar 25 13:15:21.681369 ERROR DAP 3 ap_network: Observer
10.10.101.2 is not accepting TZSP packets
To prevent ICMP error messages from the observer, D-Link recommends using the Netcat application
on the observer to listen to UDP packets on the TZSP port.
To configure a snoop filter, use the following command:
set snoop filter-name [condition-list] [observer ip-addr] [snap-length num]
The filter-name can be up to 15 alphanumeric characters.
D-Link DWS-1008 User Manual

Configuring a Snoop Filter