102
Tools
When you are capturing traffic on the radio interface, you can disable beacon trace, but other
802.11 control frames are still sent to Wireshark. You can set up a display filter to show only the
following:
•
Data frames in the trace
•
Traffic on specific BSSIDs
•
Traffic between two clients
Some examples of useful display filters are the following:
•
Exclude beacons and ACK/RTS/CTS frames:
!(wlan.fc.type_subtype == 8 || wlan.fc.type == 1)
•
Data frames only:
wlan.fc.type == 2
•
Traffic on a specific BSSID:
wlan.bssid == 00:02:bc:00:17:d0
•
All traffic to and from a specific client:
wlan.addr == 00:00:e8:4e:5f:8e
Performance and security considerations
In remote packet trace mode, traffic is sent to the PC running Wireshark via one of the network
interfaces. Depending on where the Wireshark tool is located, the traffic can be sent on an
Ethernet interface or one of the radios. To avoid a traffic flood caused by tracing the trace
packets, the M210 automatically installs a trace filter to filter out all packets destined to the
Wireshark application. For example, if the Wireshark IP port is configured to be 58000, then
the following trace filter is automatically installed on the M210:
not portrange 58000-58004
Enabling the packet trace feature impacts M210 performance and can create a security issue
(unauthorized clients may be able to connect to the AP and trace user data). The M210
performance is negatively impacted even if there is no active Wireshark session with the AP.
The performance is negatively impacted to a greater extent when packet trace is in progress.
Due to performance and security issues, the packet trace mode is not saved in nonvolatile
memory on the M210. If the M210 resets, the trace mode is disabled and you must re-enable it
to resume capturing traffic. Packet trace parameters (other than mode) are saved in nonvolatile
memory.
To minimize any performance impact on the M210 while traffic trace is in progress, you should
install trace filters to limit which traffic is sent to the Wireshark tool. When capturing 802.11
traffic, a large portion of the captured frames tend to be beacons (typically sent every 100 ms
by all APs). Although Wireshark supports a display filter for beacon frames, it does not support
a trace filter to prevent the M210 from forwarding captured beacon packets to the Wireshark
tool. To reduce the performance impact of capturing the 802.11 beacons, you can disable the
trace beacons mode.
Содержание M210
Страница 6: ...6 ...
Страница 30: ...30 Managing the M210 ...
Страница 32: ...32 Managing the M210 ...
Страница 46: ...46 Working with wireless communities and authentication ...
Страница 74: ...74 Creating WDS links ...
Страница 106: ...106 Tools ...
Страница 110: ...110 ...