How to capture wireless traffic on an Instant AP?

Aruba Employee
Aruba Employee

This article applies to Aruba Instant Access Points running Aruba Instant version and above.


Wireless packet capture is an advance level of troubleshooting and is generally considered when the issue or problem cannot be identified from an IAP or Client prospective. This feature is not available on Instant GUI and have to run from the CLI.

Capture is basically enabled on base BSSID of an particular instant AP where the client is connected and the AP would copies the wireless traffic to a wired PC running packet capture utility such as Wireshark. Every Instant AP has a base BSSID irrespective of number of SSID's it is broadcasting.

(NOTE: Make sure to check the connectivity between wired PC and the respective Instant AP before starting the capture.)

Follow the steps below to initiate wireless capture:

1. Enable Terminal Access from Instant GUI. (Go to System  -> General tab). By default Telnet or terminal access is disable.
2. Use the command "show ap monitor status" and look the below section from the command output.


In the example above, the base bssid for 80211a is "00:24:6c:ae:81:68" and "00:24:6c:ae:81:60"

3. Use the below command:

"pcap start <base bssid> <ip address of PC with Aruba version of Wireshark installed> <port> 0 1518"

For example:


4. Use "show pcap" to check the active pcap session


5. Use the command "pcap stop <base bssid> <pcap-id>" to stop the capture:

User-added image

(NOTE: Run the Aruba version of Wireshark on the PC, on the capture interface, select ARUBA udp-port=5555)

Version history
Revision #:
1 of 1
Last update:
‎06-26-2014 01:53 PM
Updated by:
Labels (1)
Search Airheads
Showing results for 
Search instead for 
Did you mean: