Information about Sniffer
The controller enables you to configure an access point as a network “sniffer”, which captures and forwards all the packets on a particular channel to a remote machine that runs packet analyzer software. These packets contain information on time stamps, signal strength, packet sizes, and so on.
Sniffers allow you to monitor and record network activity, and detect problems.
Since the WAN has limited bandwidth and the client does not require to overrun it with sniffed traffic that is received from the AP in sniffer mode. So, the traffic is entirely redirected from the switch to the system and the connection with the controller will not be dropped because the keepalive packets are disabled.
The packet analyser machine configured receives the 802.11 traffic encapsulated using the Airopeek protocol from the controller management IP address with source port UDP/5555 and destination UDP/5000.
You must use Clear in AP mode to return the AP back to client-serving mode, for example the local mode or flexconnect mode depending on the remote site tag configuration.