The challenges we face today to get wireless packet capture for Roaming and wireless Auth scenario.
#client going out of coverage.
#client roamed to another AP/channel that's not getting sniffed.
#Roaming didn't take place.
#Failover roaming happened.
#Noise/Interference.
To isolate client and AP connectivity issues ie., AP/client auth/asso/data rate/roaming/any wireless parameters and for RF related issues(interference/noise).
1. Take sniffer with 3 cards, set each card on different channels. This can be done with Omnipeek (different cards supported) or Wireshark (using Airpcap cards). Normally, partners/Cisco have this type of setup, It is not normal for a customer to have it. TAC can publish a Omnipeek tool that can capture the traffic on multiple cards, so if you have 3 USB wirelss cards + powered hub, it could be used (not all cards are supported by Omnipeek) TAC can then decode this traffic and send it to us for analysis.
2. Enable ap packet dump feature(config ap packet-dump), available from 7.3 and higher.
That works over local mode APs, and will send all traffic for a given mac client, to a FTP server... it works as a sort of wireless capture, on what the AP is getting about a specific client. It will not show if the client is sending to wrong BSSID, etc.. as it is not an over the air capture, but what the radio driver tx/rx on that mac.
3.
Applicable for non RF(noise/interference) related issues:
1. Get a hold of a device under test and move it to some quiet space where you can experiment
2. configure two APs there as desired by the device under test
3. Get two sniffers of any kind, put them on the 2 APs' on different channel
4. Start roaming the client between the AP
5. Time synced Wireless capture, debug client and AP debugs might help big time.
(Unfortunately, if cust can't setup an quite environment for some reason, use ap group and Create an test ssid duplicating the production ssid that’s having issue on two selected APs)
How to setup packet capture:
https://supportforums.cisco.com/docs/DOC-19232
