To avoid a traffic flood caused by tracing the packets, the WAP device automatically installs a capture filter to filter out all packets destined to the Wireshark application.

Depending on the location of the Wireshark tool, the traffic can be sent on an Ethernet interface or one of the radios. In remote capture mode, traffic is sent to the computer running Wireshark through one of the network interfaces. !(wlan.fc.type_subtype = 8 | | wlan.fc.type = 1)Īll traffic to and from a specific client: Some examples of useful display filters are: Traffic on specific Basic Service Set IDs (BSSIDs). You can set up a display filter to show only: When you are capturing traffic on the radio interface, you can disable beacon capture, but other 802.11 control frames are still sent to Wireshark. We recommend that if you do not use the default port use a port number greater than 1024. Verify that you have four consecutive port numbers available. The system uses four consecutive port numbers, starting with the configured port for the remote packet capture sessions.

Download wireshark linux