Configure Packet Capture on a WAP125 or WAP581 Access Point

Objective

The Packet Capture feature enables capturing and storing packets received and transmitted by the Wireless Access Point (WAP). The captured packets can then be analyzed by a network protocol analyzer for troubleshooting or performance optimization. There are two methods of packet capture:

• Save File on this Device - Captured packets are stored in a file on the WAP. The WAP can also send the file to a Trivial File Transport Protocol (TFTP) server. The file Administration Packet Capture is formatted in pcap format and can be examined using tools such as Wireshark and OmniPeek.
• Stream to a Remote Host - Captured packets are redirected in real time to an external computer running the Wireshark tool.

This article aims to explain and guide you on configuring Packet Capture on a WAP and receive these packet captures locally or remotely.

Applicable Devices

• WAP125
• WAP581

Software Version

• 1.0.0.4 - WAP581
• 1.0.0.5 - WAP125

Configure Packet Capture Settings

Step 1. Log in to the web-based utility of your WAP. The default username and password is cisco/cisco.

Note: If you already have changed the password or created a new account, enter your new credentials instead.

Step 2. Choose Troubleshoot > Packet Capture.

Note: The available options may vary depending on the exact model of your device. In this example, WAP125 is used.

Step 3. Choose one of the following Packet Capture Method radio buttons:

• Save File on this Device - Stores the captured packets as a file on the WAP. Configure the Interface, duration, and maximum file size to be saved locally.
• Stream to a Remote Host - Redirects the captured packets in real time to an external computer that runs the network protocol analyzer tools. If this is chosen, skip to Step 7.

Note: In this example, Save File on this Device is chosen.

Step 4. From the Interface drop-down list, choose the interface for which the packets are to be captured from the Capture Interface drop-down list. The options are:

• Ethernet - 802.3 traffic on the Ethernet port.
• Radio 1 - 802.11 traffic on the radio interface 1.
• Radio 2 - 802.11 traffic on the radio interface 2.

Note: In this example, Radio 1 is chosen.

Step 5. Enter the capture duration in the Duration field ranging from 10 to 3600 seconds. The default is 60 seconds.

Note: In this example, 61 is used.

Step 6. In the Max File Size field, enter the maximum capture file size ranging from 64 to 4096 KB then skip to Step 8. The default is 1024 KB.

Note: In this example, the default value is used.

Step 7. If remote packet capture method is chosen, enter the port number ranging from 1 to 65530 in the Remote Capture Port field. The default is 2002.

Note: In this example, the default port is used.

Step 8. From the Mode drop-down list, choose which packets will be captured. The options are:

• All Wireless Traffic - Captures all the wireless packets, including those sent on other networks.
• Traffic to/from this AP  Capture packets that are sent between the WAP and the clients. In this example, this option is chosen.

Step 9. Check the Enable Filters check box to allow specific filters on packet capture.

Step 10. (Optional) Check the Ignore Beacons check box to disable the capturing of 802.11 beacons detected or transmitted by the radio. Beacon frames are transmitted periodically to announce the presence of a Wireless Local Area Network (WLAN).

Note: In this example, Ignore Beacons is enabled.

Step 11. (Optional) Check the Filter on Client check box to specify a MAC address of a wireless client.

Note: In this example, the Filter on Client is unchecked.

Step 12. (Optional) Enter the MAC address of the client in the Filter on Client field. This is only active if Packet Capture is performed on a radio interface.

Note: In this example, Filter on Client is disabled.

Step 13. Check the Filter on SSID check box to capture packets on a specific SSID.

Step 14. From the SSID drop-down list, choose an SSID to capture packets.

Note: The SSIDs that appear in the drop-down list depend on what interface was chosen and how many SSIDs have been configured. In this example, Rick is chosen.

Step 15. Click the Save button to save the configured settings.

You should now have successfully configured the Packet Capture settings.

Packet Capture

Step 16. The Packet Capture Status area contains the following information. Click Refresh to view the current status.

• Current Capture Status - Displays the current packet capture status. In this example, - Stopped due to administrative action - is the current status.
• Packet Capture Time - Displays the duration for which the packets are captured. In this example, 00:00:17 seconds was recorded.
• Packet Capture File Size - Displays the size of the packet captured file. In this example, 1024kb is the capture size.

Step 17. Click the Start Capture button to start the packet capture process.

Step 18. A window will pop up to inform you that the Packet Capture will now commence. Click OK to continue.

Step 19. Click the Stop Capture button to stop the packet capture process.

Step 20.A window will pop up to inform you to confirm to end the packet capture. Click OK to continue.

You should now have successfully captured packets on your access point.

Packet Capture File Download

Download to this Device

Step 1. Click the Download to this Device button.

Step 2. A window will pop up to commence the download. Click OK continue.

Once the download is complete, the downloaded file will appear in your browser download history. The file is downloaded with HTTP/HTTPS and the file format is .pcap.

Note: In this example, apcapture.pcap is the downloaded file.

You have successfully downloaded the packet capture file of your WAP to your computer.

Download to TFTP Server

Step 1. (Optional) If the captured file has to be downloaded through a TFTP server, click the Download to TFTP Server button.

Once clicked, a window will appear with the Server IPv4 Address and Destination File Name fields.

Step 2. Enter the IPv4 address of the TFTP server in the Server IPv4 Address field. The port number entered in the Remote Capture Port field in Step 6 is then attached to the TFTP server address.

Note: In this example, 128.12.8.128 is used.

Step 3. Enter the file name in pcap format in the Destination File Name field.

Note: In this example, apcapture.pcap is used.

Step 4. Click Download.

A progress bar appears below the Destination File Name field.

You should now have downloaded your Packet Capture file through a TFTP server.