Capture the DHCP messages over WiFi

[msompong1]

Hi All,

I am using the WLC with FlexConnect mode , I have the external DHCP server for assign the IP address to clients (by using  IP helper from SVI interface of Layer3 switch).

I'm trying to capture the DHCP message between client and DHCP server and noticed that I cannot see the message from SVI (as the IP helper) to my client , But the client can receive IP address and the DHCP server show the IP address has been sent to the client.

Could someone provide me the reason of this?

Note. The Wireshark computer connect the same AP of the testing client.

 

[Scott Fella]

I'm not understanding the question.  Your device is working fine and getting dhcp, you just want to capture this from the device running wireshark or you trying to capture this over the air using a wireless capture?

[Rasika Nayanajith]

Usually when you capture over-the-air, that laptop should not connect to any SSID/AP. You should put that sniffer WiFI card into monitor mode and set channel to sniff traffic, in that way you will capture all traffic on that channel and you will not miss anything. Pls clarify how your capture is setup

HTH

Rasika

[msompong1]

Hi Rasika,

The capture done by using laptop with Wireshark connect to the same AP with the interested client.

Thanks

Sompong M.

[Scott Fella]

Rasika is telling you how you need to perform a capture the right way.

[Rich R]

Not all WiFi adapters and/or drivers support WiFi capture or promiscuous mode so you need:

- WiFi hardware which supports wireless capture

- WiFi driver which supports wireless capture

- Correct configuration to do the wireless capture like Scott and Rasika have pointed out.

There's a whole wiki article about it at https://wiki.wireshark.org/CaptureSetup/WLAN

Although it's in need of an update it highlights the problems with doing wireless captures, especially on Windows.

If you are serious about wireless capture then buy the correct WiFi adapter (designed specially for capture) with specialist drivers.

Or use a dedicated WiFi sniffer appliance or tool like https://www.netally.com/products/aircheck/