Cisco WAP125 Administrator's Manual page 108

Wireshark
To initiate the Wireshark network analyzer tool for Microsoft Windows, follow these steps:
Step 1 On your computer, initiate the Wireshark tool.
Step 2 In the menu, click Capture > Options. A popup window appears.
Step 3 In the Interface field, select Remote. A popup window appears.
Step 4
In the Host field, enter the IP address of the WAP device.
Step 5 In the Port field, enter the port number of the WAP device. For example, enter 2002 if you used the default, or enter the
port number if you used a port other than the default.
Step 6
Click OK.
Step 7 Select the interface from which you need to capture the packets. At the Wireshark popup window, next to the IP address,
there is a drop-down menu to select the interfaces. The interface can be one of the following:
Linux bridge interface in the wap device
--rpcap://[192.168.1.220]:2002/brtrunk
Wired LAN interface
-- rpcap://[192.168.1.220]:2002/eth0
VAP0 traffic on radio 1
-- rpcap://[192.168.1.220]:2002/wlan0
802.11 traffic
-- rpcap://[192.168.1.220]:2002/radio1
At WAP361, VAP1 ~ VAP7 traffic
-- rpcap://[192.168.1.220]:2002/wlan0vap1 ~ wlan0vap7
At WAP150, VAP1 ~ VAP3 traffic
-- rpcap://[192.168.1.220]:2002/wlan0vap1 ~ wlan0vap3
You can trace up to four interfaces on the WAP device simultaneously. However, you must start a separate Wireshark
session for each interface. To initiate additional remote capture sessions, repeat the Wireshark configuration steps. No
configuration required on the WAP device.
The system uses four consecutive port numbers, starting with the configured port for the remote packet capture
Note
sessions. Verify that you have four consecutive port numbers available. We recommend that if you do not use
the default port; use a port number greater than 1024.
When you are capturing traffic on the radio interface, you can disable beacon capture, but other 802.11 control
frames are still sent to Wireshark. You can set up a display filter to show only:
• Data frames in the trace.
• Traffic on specific Basic Service Set IDs (BSSIDs).
• Traffic between two clients.
Some examples of useful display filters are:
• Exclude beacons and ACK/RTS/CTS frames:
!(wlan.fc.type_subtype == 8 | | wlan.fc.type == 1)
• Data frames only:
wlan.fc.type == 2
• Traffic on a specific BSSID:
wlan.bssid == 00:02:bc:00:17:d0
Cisco WAP125 Wireless-AC/N Dual Band Desktop Access Point with PoE
102
Troubleshoot