Wireless Access

Reply
MVP
Posts: 1,111
Registered: ‎10-11-2011

Using the packet-capture command

I'm looking to capture the unencrypted traffic from a client.  I can't use a SPAN at the moment, so it looks like the packet-capture command is my only option.  I've used this command in the past for tiny packet captures and it worked just fine.  However, I need to perform a packet capture that will last a few minutes and I'm not sure how big it will end up being.  I'm left with the following questions:

 

1) When using the destination local-filesystem syntax, what happens if the packet capture fills gets too large and fills up flash?  Do I run the risk of causing issues for connected APs and clients?

 

2) If I want to avoid filling up flash and use the destination ip-address syntax instead, how does this work?   Does this work the same as ap packet-capture and the Wireshark Aruba decode must be used?  I tried using OmniPeek and the Aruba Adapter but never saw traffic.

=======================================
If a reply adequately addresses your issue, please click on the "Accept as Solution" and "Give Kudos" button so this information can benefit other users.
Regular Contributor II
Posts: 207
Registered: ‎09-28-2010

Re: Using the packet-capture command

Guru Elite
Posts: 8,761
Registered: ‎09-08-2010

Re: Using the packet-capture command

I use the destination-ip option regularly with Wireshark and the standard Aruba ERM filter.

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
MVP
Posts: 1,111
Registered: ‎10-11-2011

Re: Using the packet-capture command

Thanks for the info.  After testing with with the ERM filter on I wasn't seeing the unencrypted client traffic.  I tried again with no filters and started seeing the unencrypted user traffic.  The unencrypted traffic is sent via GRE which explains why the ERM filter wasn't catching the packets.

=======================================
If a reply adequately addresses your issue, please click on the "Accept as Solution" and "Give Kudos" button so this information can benefit other users.
Search Airheads
Showing results for 
Search instead for 
Did you mean: