If you try to capture wireless traffic by selecting wireless interface on wireshark, it will not accurately capture the wireless packets over the air. Normally you require separate wireless adapter to do this sort of work. But there is a free tool you can use in Windows operating system.

Microsoft has developed a capturing tool called “Microsoft Network Monitor” which can be used to capture the wireless traffic over the air. You can download this tool freely from Microsoft.(http://www.microsoft.com/en-us/download/details.aspx?id=4865).Operating System requirement is as below.

Supported operating systems: Windows 7, Windows Server 2003 Service Pack 2, Windows Server 2003 Service Pack 2 x64 Edition, Windows Server 2008, Windows Server 2008 R2, Windows Server 2008 R2 for Itanium-based Systems, Windows Vista 64-bit Editions Service Pack 1, Windows Vista Service Pack 1, Windows XP 64-bit, Windows XP Service Pack 3

In my windows7 machine I have installed this & here are the instructions to get a wireless sniffing done using this tool.Once you open the application select wireless interface card under the select network section as highlighted below.

Then click “New Capture” & click the “Capture Settings”.

If you click on the highlighted wireless network connection, you will see a screen like below . Click Scanning option.

You need to know which channel wireless traffic you need to capture. In my example my Cisco7921 phone is operating in 802.11a band -CH149.

(WLC1) >show client summary 
Number of Clients................................ 2
MAC Address       AP Name           Status        WLAN/GLAN      Auth Protocol         Port Wired
----------------- ----------------- ------------- -------------- ---- ---------------- ---- -----
00:1b:d4:58:e6:1a HQ-AP01           Associated    2              Yes  802.11a          1    No
a0:88:b4:35:c2:f0 HQ-AP01           Associated    2              Yes  802.11n(5 GHz)   1    No

(WLC1) >show client detail 00:1b:d4:58:e6:1a
Client MAC Address............................... 00:1b:d4:58:e6:1a
Client Username ................................. N/A
AP MAC Address................................... a0:cf:5b:9e:e8:20
AP Name.......................................... HQ-AP01           
Client State..................................... Associated     
Client NAC OOB State............................. Access
Wireless LAN Id.................................. 2  
BSSID............................................ a0:cf:5b:9e:e8:2e  
Connected For ................................... 3145 secs
Channel.......................................... 149
IP Address....................................... 10.10.15.53
Association Id................................... 3  
Authentication Algorithm......................... Open System
Reason Code...................................... 1  
Status Code...................................... 0  
Session Timeout.................................. 0  
Client CCX version............................... 4  
Client E2E version............................... No E2E support
Mirroring........................................ Disabled
QoS Level........................................ Platinum
802.1P Priority Tag.............................. 6
WMM Support...................................... Enabled

To capture the traffic tick “Switch to Monitor mode” check box & select the channel you want to sniff traffic( in my case 802.11a- CH149). Then click ” Apply” button.Do not click “Close & Return to Local Mode”. You will notice your normal wireless connection will be disconnected, once you select this “Monitor mode”

Then click the “start” buttone next to the “Capture Setting” as show in the 2nd screenshot in this post. Then stop the capture once you get the enough packets captured. In my example I have made a call from 7921 phone while this capture is collecting. Save this file in your computer & open it using wireshark. You will see 802.11 packets in your capture.

Here is my capture output. you will see different type of wireless frames (Beacon, ACK, Data Frame, etc) on channel 149 in 802.11a. If you click on different type of frame you will see all the information on these wireless packet. Below is the RPT data frame going from wireless phone to soft phone in a wired media.

you will notice that this RTP traffic IP heade marked as DSCP EF by the C7921 phone. when it release to wireless media it has set QoS value 6 (keep in mind this is WMM UP value & different to Cisco’s 802.11p values in AVVID model). Centre freqency 5745 is the CH149 (UNNII-3 band) in 802.11a. If you look at the signaling traffic goes from phone to CME, it will looks like thisNoticed that even though inner DSCP value is Zero, WMM is categorize this WMM- UP4 (Controlled Load). I thought inner DSCP would be CS3 in this instance.

If you look at the Beacon frame send by the Access point, you will see information send by AP to its clients. Highlighted few QoS related parameters (QBSS load, AIFS values,U-APSD) values set by the AP. I found following discussions in Cisco Support forum on this topic useful as well. Feel free to read those as well.

802.11 packet sniffing