HP Pavilion 501, Configuration And Administration Manual

Page: 58 / 64

58 Tools
When you are capturing traffic on the radio interface, you can disable beacon trace, but other
802.11 control frames are still sent to Wireshark. You can set up a display filter to show only the
following:
•
Data frames in the trace
•
Traffic on specific BSSIDs
The following are examples of useful display filters:
•
Exclude beacons and ACK/RTS/CTS frames:
!(wlan.fc.type_subtype == 8 || wlan.fc.type == 1)
•
Data frames only:
wlan.fc.type == 2
•
Traffic on a specific BSSID:
wlan.bssid == 00:02:bc:00:17:d0
Note
If you stop the remote trace on the HP 501, restarting it will not resume the Wireshark capture
automatically. You must restart the capture in Wireshark after you restart the remote trace in
HP 501.
Performance and security considerations
In remote packet trace mode, traffic is sent to the PC running Wireshark via one of the network
interfaces. Depending on where the Wireshark tool is located, the traffic can be sent on an
Ethernet interface or the radio. To avoid a traffic flood caused by tracing the trace packets, the
HP 501 automatically installs a trace filter to filter out all packets destined to the Wireshark
application. For example, if the Wireshark IP port is configured to be 58000, the following
trace filter is automatically installed on the HP 501:
not portrange 58000-58004
Enabling the packet trace feature impacts HP 501 performance, even if there is no active
Wireshark session. Performance is negatively impacted to a greater extent when packet trace is
in progress.
Due to performance and security issues, the packet trace mode is not saved in nonvolatile
memory on the HP 501. If the HP 501 resets, the trace mode is disabled and you must re-
enable it to resume capturing traffic. Packet trace parameters (other than mode) are saved in
nonvolatile memory.
To minimize performance impact on the HP 501 while traffic trace is in progress, HP
recommends that you install trace filters to limit the traffic sent to the Wireshark tool. When
capturing 802.11 traffic, a large portion of the captured frames tend to be beacons (typically
sent every 100 ms by all APs). Although Wireshark supports a display filter for beacon frames,
it does not support a trace filter to prevent the HP 501 from forwarding captured beacon
packets to the Wireshark tool. To reduce the performance impact of capturing the 802.11
beacons, you can disable the trace beacons mode.
The remote packet trace facility is a standard feature of the Wireshark tool for Windows.