In this post we will see how to capture 802.11ac wireless frames using Cisco AP (802.11ac AP like 3700/2700/1700) as remote adapter. I have used OmniPeek WiFi Analyzer (10-day trial version) as protocol analyzer (as Wireshark is not yet support 802.11ac frame analysis).
I have installed OmniPeek on my PC (IP x.x.13.20). I have created an Open SSID on my WLC (5508) to connect iPhone6 (single spatial stream 802.11ac client). Also a wired 7965-VoIP connected to make a voice call from iPhone6 (with Jabber client) to that.
First you have to register your 3700 AP to your WLC & then you have to convert it to “sniffer mode“. Once you change the mode AP will reboot. Note that sniffer mode you cannot associate client to that AP. You can do it via GUI or CLI here is the CLI method (my AP name is “SNIFFER-3700“).
(WLC) >config ap mode ? Local Local mode for the Cisco AP. bridge Bridge mode for the Cisco AP. flex+bridge Flex+Bridge mode for the Cisco AP. flexconnect flexconnect mode for the Cisco AP. monitor Monitor Only mode for the Cisco AP. reap Remote Edge AP (REAP) mode for the Cisco AP. rogue Rogue Detector mode for the Cisco AP. se-connect Spectrum Expert Only Connect mode for the Cisco AP. sniffer Wireless sniffer mode for the Cisco AP. (WLC) >config ap mode sniffer SNIFFER-3700 Changing the AP's mode or submode will cause the AP to reboot. Are you sure you want to continue? (y/n) y
In GUI, you can do this simply go to the AP general page as shown below.
Then you have to set the sniffing channel on this AP. Since I want to sniff traffic on 802.11a (5GHz) on CH149 (149,153,157,161) I have to set my sniffer AP to that channel & specify the OmniPeek running PC as sniffer server.
Here how you can do it via CLI.
(WLC) >config ap sniff ? 802.11a Enables/Disables sniffing on 802.11a radio. 802.11b Enables/Disables sniffing on 802.11b/g radio. (WLC) >config ap sniff 802.11a ? enable Enables sniffing. disable Disable sniffing. (WLC) >config ap sniff 802.11a enable ? <channel> Enter a valid 802.11a channel to be sniffed (WLC) >config ap sniff 802.11a enable 149 ? <Server-IpAddr> Enter Sniffer server (remote Airopeek) IP address. (WLC) >config ap sniff 802.11a enable 149 x.x.13.20 ? <Cisco AP> Enter the name of the Cisco AP. (WLC) >config ap sniff 802.11a enable 149 x.x.13.20 SNIFFER-3700
In GUI, you can go to “Wireless -> Radio -> 802.11a/n/ac -> AP_Name ->Configure” option as shown below.
Then you can go to OmniPeek & start new capture. You have to select “Cisco Remote Adapter” option as shown below & give any name you like. You do not want to give the sniffer mode AP IP address unless you want to filter traffic from multiple sniffer mode APs.(once you put IP field blank, you can collect captures from all sniffer mode APs)
Here is a snapshot of my packet capture while making a call from iPhone6-Jabber client to 7965 VoIP phone. As you can see management frames (eg Beacon) transmit in highest mandatory rate (24Mbps) configured where as data frames get 802.11ac data rates.
Here is a Beacon frame of the above capture. As you can see it is transmitted at 24Mbps (highest mandatory rate configured on 802.11a band in my WLC). Note that it is advetising VHT – 802.11ac capability.
Here is a data frame carrying SIP traffic (from iPhone6 jabber client to UCCM server). It is transmitted 292.5Mbps (80MHz, 1SS MCS 7 rate). As you can see even though the original IP packet has DSCP of 24 (CS3) for this SIP traffic it is mapped to UP value of 0 (Best Effort) in Wireless header. Usually this UP value get converted to outer CAPWAP header by AP.
Here is a data frame carrying RTP traffic. You can see it is a frame transmitted in 292.5Mpbs (80MHz, 1SS-MCS7 data rate). As you can see the original IP packet had DSCP value EF where it map to UP value of 5 (Video) in wireless header (this is controlled by supplicant)
Like this you can monitor 2SS (Macbook Air,) or 3SS (Macbook Pro) wireless traffic using AP as wireless adapter. Normally a USB adapter may not able to capture 3SS client traffic & you may need to use an enterprise grade AP to properly capture 802.11ac frames.
1. WildPacket Cisco Remote Adapter