Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

AP Sniffer Mode

Anyone have a good link on Sniffer AP mode?

__________________________________________________________________________________________ "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin ___________________________________________________________
1 ACCEPTED SOLUTION

Accepted Solutions
New Member

Re: AP Sniffer Mode

Configure AP Sniffer mode as describe in the previous link.

The "Server IP address" is the address of the host where Wireshark is installed.

The WLC will sent UDP packets (with source port 5555) to the Wireshark host (with destination port 5000).

In Wireshark, follow the UDP stream and then decode UDP destination 5000 as "AIROPEEK" transport protocol.

You should now be able the see the frames captured by the AP on the selected channel.

9 REPLIES
Hall of Fame Super Gold

Re: AP Sniffer Mode

Try this link:

http://www.cisco.com/en/US/docs/wireless/controller/5.1/command/reference/cli51c1.html#wp4762048

"It will capture and forward all the packets from the clients on that channel to a remote machine that runs AiroPeek (A packet analyzer for IEEE 802.11 wireless LANs). It will include information on timestamp, signal strength, packet size and so on."

Re: AP Sniffer Mode

Thank you .... its interesting ... it states other analyzers, but only the plug in for Airo...

"When the sniffer feature is enabled on an access point, it starts sniffing the signal on the given channel. It captures and forwards all the packets to the remote computer that runs Omnipeek, Airopeek, AirMagnet, or Wireshark. It includes information on timestamp, signal strength, packet size and so on.

Before an access point can act as a sniffer, a remote computer that runs one of the listed packet analysers must be set up so that it can receive packets sent by the access point. After the Airopeek installation, copy the following .dll files to the location where airopeek is installed."

Does this mean you need the Airo plug for all the other analyzer too?

__________________________________________________________________________________________ "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin ___________________________________________________________
Hall of Fame Super Gold

Re: AP Sniffer Mode

I believe this is a .DLL plug-in. So yes.

New Member

Re: AP Sniffer Mode

Has anyone ever managed to do Sniffer mode with Wireshark? If yes, please share how you did it - unfortunately the Cisco documentation is very poor about that.

Re: AP Sniffer Mode

i found a bit more info and links...

http://www.cisco.com/en/US/docs/wireless/controller/5.1/configuration/guide/c51err.html#wp1042843

__________________________________________________________________________________________ "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin ___________________________________________________________
New Member

Re: AP Sniffer Mode

Configure AP Sniffer mode as describe in the previous link.

The "Server IP address" is the address of the host where Wireshark is installed.

The WLC will sent UDP packets (with source port 5555) to the Wireshark host (with destination port 5000).

In Wireshark, follow the UDP stream and then decode UDP destination 5000 as "AIROPEEK" transport protocol.

You should now be able the see the frames captured by the AP on the selected channel.

Re: AP Sniffer Mode

getting closer! thank you for your reply!

Question, is there a link how to decode as AIROPEEK, so i can read up ? THANKS AGAIN!

__________________________________________________________________________________________ "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin ___________________________________________________________

Re: AP Sniffer Mode

i got it ... THANK YOU SO MUCH!

__________________________________________________________________________________________ "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin ___________________________________________________________

Re: AP Sniffer Mode

Refer to the link below on how to configure the Cisco AP in sniffer mode.

http://www.wildpackets.com/ciscoapgrabber_video

Kindly rate this post if it is useful.

Please rate replies and mark question as "answered" if applicable.
5362
Views
8
Helpful
9
Replies