topic If your intention is to see in Wireless

Client Packet capture question

ALIAOF_ — Mon, 05 Jul 2021 12:07:54 GMT

If I have a client MAC address and I span WLC port and truy to capture client traffic in wireshark using client MAC will I be able to? Or will it only show me WLC's MAC?

If that traffic is encrypted

Rasika Nayanajith — Thu, 26 May 2016 23:37:37 GMT

If that traffic is encrypted (eg 802.1X SSID or PSK) then you may not see client mac address.

You will see AP & WLC addresses in CAPWAP headers & not client address. If it is open SSID traffic, you will see client address in Data section.

HTH

Rasika

*** Pls rate all useful responses ***

Ah gotcha thank you for your

ALIAOF_ — Fri, 27 May 2016 11:48:46 GMT

Ah gotcha thank you for your reply. Would it make a difference if I trunk the port where AP is connected? One of my colleague was telling me that it is possible to see it by trunking the port on the AP and then spanning the WLC port.

I'm inclined to believe we will get the same results however best way to capture client traffic would be to use some kind of WLAN packet capture or utilize the AP in sniffer mode or do a capture on the WLC itself.

If your intention is to see

Rasika Nayanajith — Fri, 27 May 2016 19:59:06 GMT

If your intention is to see secured SSID client data traffic while it goes from AP to WLC, that won't help.

For a PSK secured SSID , you can decrypt as long as you capture full conversation including 4 way handshake. See below post on that

https://mrncciew.com/2014/08/16/decrypt-wpa2-psk-using-wireshark/

If it is 802.1X SSID traffic, there is no way to decrypt & see what's exactly in it.

Need to mention, once you capture WLC trunk port traffic you would able to see traffic goes to wired network (AP -> WLC -> Wired Network) from WLC, this traffic is not encrypted & you would able to see that traffic.

HTH

Rasika

*** Pls rate all useful responses ***