Remote Packet Capture - Cisco WAP121 Administration Manual

Administration
Packet Capture
NOTE
STEP 1
STEP 2
STEP 3
STEP 4
STEP 5
STEP 6
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE
Click Refresh to display the latest data from the WAP device.
To stop a packet file capture, click Stop Capture.

Remote Packet Capture

The Remote Packet Capture feature enables you to specify a remote port as the
destination for packet captures. This feature works in conjunction with the
Wireshark network analyzer tool for Windows. A packet capture server runs on the
WAP device and sends the captured packets through a TCP connection to the
Wireshark tool. Wireshark is an open source tool and is available for free; it can be
downloaded from http://www.wireshark.org.
A Microsoft Windows computer running the Wireshark tool allows you to display,
log, and analyze captured traffic. The remote packet capture facility is a standard
feature of the Wireshark tool for Windows. Remote packet capture is not standard
on the Linux version of Wireshark and the Linux version does not work with the
WAP device.
When remote capture mode is in use, the WAP device does not store any captured
data locally in its file system.
If a firewall is installed between the Wireshark computer and the WAP device,
these ports must be allowed to pass through the firewall. The firewall must also be
configured to allow the Wireshark computer to initiate TCP connection to the WAP
device.
To initiate a remote capture on a WAP device:
Click Administration > Packet Capture.
Enable Promiscuous Capture.
Select the Remote radio button.
Use the default port (2002), or if you are using a port other than the default, enter
the desired port number used for connecting Wireshark to the WAP device.
Click Save.
Click Start Capture.
3
51