Cisco WAP121 Administration Manual page 52

Administration
Packet Capture
STEP 1
STEP 2
STEP 3
STEP 4
STEP 5
STEP 6
STEP 7
NOTE
Cisco Small Business WAP121 and WAP321 Wireless-N Access Point with PoE
To initiate the Wireshark network analyzer tool for Microsoft Windows:
On the same computer, initiate the Wireshark tool.
In the menu, select Capture > Options. A pop-up appears.
At Interface, select Remote. A pop-up appears.
At Host, enter the IP address of the WAP device.
At Port, enter the port number of the WAP. For example, enter 2002 if you used the
default, or enter the port number if you used a port other than the default.
Click OK.
Depending on the interface from which you need to capture packets, select an
interface for capture. At the Wireshark pop-up, next to the IP address, there is a
pulldown list for you to select the interfaces. The interface can be one of the
following:
Linux bridge interface in the wap device
--rpcap://[192.168.1.220]:2002/brtrunk
Wired LAN interface
-- rpcap://[192.168.1.220]:2002/eth0
VAP0 traffic on radio 1
-- rpcap://[192.168.1.220]:2002/wlan0
802.11 traffic
-- rpcap://[192.168.1.220]:2002/radio1
At WAP321, VAP1 ~ VAP7 traffic
-- rpcap://[ 192.168.1.220]:2002/wlan0vap1 ~ wlan0vap7
At WAP121, VAP1 ~ VAP3 traffic
-- rpcap://[ 192.168.1.220]:2002/wlan0vap1 ~ wlan0vap3
You can trace up to four interfaces on the WAP device at the same time. However,
you must start a separate Wireshark session for each interface. To initiate
additional remote capture sessions, repeat the Wireshark configuration steps; no
configuration needs to be done on the WAP device.
The system uses four consecutive port numbers, starting with the configured port
for the remote packet capture sessions. Verify that you have four consecutive port
numbers available. We recommend that if you do not use the default port, use a port
after 1024.
When you are capturing traffic on the radio interface, you can disable beacon
capture, but other 802. 1 1 control frames are still sent to Wireshark. You can set up
a display filter to show only:
• Data frames in the trace
3
52