Capturing 802.11 frames with Ruckus Wireless access points and Wireshark

  • 1
  • Praise
  • Updated 1 year ago
Spotted on Twitter

Our Community Champ Primoz (@jazzycow81) just posted a very nice howto blog on setting up packet capture with Ruckus products and Wireshark. Have a look http://wlanimp.blogspot.com/2014/04/c...

It should be very helpful in troubleshooting wireless network issues.

BTW, we use Wireshark internally here and so attaching a trace to your case is a great way to accelerate resolution velocity
Photo of Keith - Pack Leader

Keith - Pack Leader

  • 860 Posts
  • 51 Reply Likes

Posted 3 years ago

  • 1
Photo of Primož Marinšek

Primož Marinšek, AlphaDog

  • 413 Posts
  • 48 Reply Likes
Thanks for the bump Keith :)

I've just modified the post a bit, so it now includes how to change channels on APs which is important when using an AP just to capture frames.
Photo of Alberto de la Cruz

Alberto de la Cruz

  • 42 Posts
  • 1 Reply Like
Nice post Primoz!

I want to add that this remote capture feature only works with wireshark for windows (what is very annoying for me)
Photo of alexf

alexf

  • 22 Posts
  • 1 Reply Like
Indeed a useful post for Ruckus clients, thank you for your contribution.

You could also include some info on how to capture on the uplink of the AP (on eth0). Sometimes, when troubleshooting is useful to compare the traffic coming on the uplink of the AP with what it is actually sent on the air side.

Have you notice any impact of enabling packet capture on the AP stability?
I've seen APs crashing after enabling packet capture (whether if it was done from the ZD webUI or from the AP's CLI). We're trying to understand why.
Photo of Primož Marinšek

Primož Marinšek, AlphaDog

  • 413 Posts
  • 48 Reply Likes
Hi Alex

You could capture on the wired side also, but the intended topic of the post was how to capture packets from the air since you can do alot of troubleshooting that way.

I guess if there is any impact on AP stability it is down to some software bug rather than an overload due to the packet capture functionality in general. If capturing from a stand-alone AP I would suggest you use at least 7372 or better a 7982 AP for this since it is a 3x3 radio and the best hardware around so it shouldn't be a problem.
Photo of alexf

alexf

  • 22 Posts
  • 1 Reply Like
We actually experienced this behaviour with 7982's.
I look forward to receiving feedback from Support.
Photo of YC

YC

  • 2 Posts
  • 0 Reply Likes
We found that the setup is very useful for troubleshooting.
And it will be nice if Ruckus 11ac APs (eg r700) can support the packet capture mode as well.
We look forward to this.
Photo of Michael Brado

Michael Brado, Official Rep

  • 1968 Posts
  • 275 Reply Likes
Expected for all .11ac APs in ZD version 9.10. (next release)
Photo of YC

YC

  • 2 Posts
  • 0 Reply Likes
Hi Michael

Thanks for the update.
How about for 11ac APs in SCG200 setup? Any roadmap?
Photo of Jan Fx

Jan Fx

  • 1 Post
  • 0 Reply Likes
How do I setup a R710 wlan interface as a Monitor (MON) interface for remote packet capture?