Wireshark can decode only some of these elements, whereas OmniPeek will show all of them. the channel, signal strength, noise.) are added by the AP.

The 802.11 traffic will now be visible:.

Note: In Wireshark releases 1.8 and higher, AIROPEEK has been renamed to PEEKREMOTE.

The captured traffic has to be “decoded as.” AIROPEEK in order to be able to see the 802.11 traffic:.

Consider that the WLC sends traffic to a UDP port there’s no application listening on the sniffer side this results in having a ICMP port-unreachable response for each packet received from the WLC.Īlthough this is expected, the filter above helps to exclude also this traffic which is useless and so it can only cause the trace to be bigger and more difficult to read. This filter is optional but strongly recommended as it excludes all the non-wireless related traffic from the capture.

Set the capture options to receive only traffic on UDP/5555:.

If using Wireskark to receive the traffic, (Note: Please use the most current version of Wireless due to various decoding issues of past releases, Download Latest) follow the steps below:

The sniffer will receive the 802.11 traffic encapsulated using the airopeek protocol, from the WLC management IP address with source port UDP/5555 and destination UDP/5000.

Once the AP has re-joined the WLC, configure the radio of the AP (802.11b/g/n or 802.11a/n):.

The AP will reboot and it will not be able to serve clients.

Here are the steps in order to collect a trace using a sniffer mode LAP In order to see the RF from the point of view of the client while roaming, a multi-channel wireless trace should be captured using a laptop with multiple Wireless NICs that will follow the test client. For static scenarios, if it’s possible to move the sniffer AP, this can be used as an effective alternative to other sniffing options.įor roaming scenarios, the sniffer APs are usually installed in the proximity of the APs the client roams through, and this will report the “point of view” of the static APs rather than the client. You can use the Cisco WLC and LAPs in sniffer mode, in conjunction with a wired sniffer (feature designed for AiroPeek/Omnipeek, but can work also with Wireshark).Ī single wired sniffer can collect packets from multiple APs, so this method is very useful to run multi-channel traces.

Sniffer wireshark