Showing results for 
Search instead for 
Did you mean: 

AP in sniffer mode

Hi, i have a site where we would like to conduct some wireless sniffing but are having some issues since the problem we suspect is AP->Controller traffic.


It seems that we are losing some packets in the CAPWAP tunnel so an AP in sniffer mode on the same controller may not give the full picture.


Can a 2802I running Mobility Express software support a couple of 2702I (or maybe 2802I) AP's running in sniffer mode?


We would like to make sure that all the traffic stay onsite so this is the best solution we could come up with, as an alternative we can maybe setup a WLC onsite where the sniffer AP's can join but this would require alot more work and planning since we don't have a controller available.


Any thoughts or tips would be appreciated.


Kind regards.


3 Replies 3

Rasika Nayanajith
VIP Mentor VIP Mentor
VIP Mentor

Hi Martin,


You do not require to have local controller in branch site to have sniffer mode AP. Even WLC at a central location, as long as Sniffer mode AP can register to that (only require L3 IP reachability between WLC & AP), you are good.


My suggestion is to convert 3702 to sniffer mode and send it to branch (with appropriate CH number set to scan & set wireshark running PC IP set, it can be a device on your central site). Please follow the below post on how to set it up 




*** Pls rate all useful responses ***C

Hi Rasika,


The problem i'm facing is that there may be packet loss on in the CAPWAP tunnel the current controller, so to make sure that i don't also miss alot of the captured packets i would like to have the sniffing handled locally.


The reason being that we see alot of EAP timeouts and we can't really tell if the EAP packets are going missing in the air or in the CAPWAP tunnel or if the client never even send them to start with.


Or does the sniffer traffic not need to go through the WLC?


Hope this makes sense as to why we would like to handle the sniffing onsite.


Does the CAPWAP transit a Cisco router?

If so then run the pcap on that:

That's what we do.  Then export the pcap to router flash or directly to tftp/ftp server etc.

TAC recommended codes for AireOS WLC's
Best Practices for AireOS WLC's
TAC recommended codes for 9800 WLC's
Best Practices for 9800 WLC's
Cisco Wireless compatibility matrix
Field Notice: FN-72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Recommended
WARNING - see CSCwd37092 Throughput degraded after upgrading to code - 2800/3800/4800 series
- The fix for CSCwd37092 is now released in and
- For IOS-XE 17.3.6 select controller model, go to IOS XE Software AP Service Pack, select CSCwd40096 17.3.6 APSP2
Field Notice: FN-63942 Lightweight APs and WLCs Fail to Create CAPWAP Connections Due to Certificate
      Expiration - Software Upgrade Recommended
Field Notice: FN-72524 - During Software Upgrade/Downgrade IOS APs Might Remain in Downloading State
     After 4 Dec 2022 Due to Certificate Expiration - Fixed in and 17.3.6 APSP5 (APSP_CSCwd83653)
     Also fixed in (8.5 mainline) and (8.5 IRCM) if you can't upgrade to 8.10
     TAC confirmed that subordinate Mobility Express APs downloading by TFTP are not affected so ME still works
     Note that and have been deferred (withdrawn) and are effectively unsupported by Cisco
Leo Laohoo's list of bugs affecting 2800/3800/4800/1560 APs
Richard R
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers