topic Re: Capturing 802.11 frames with Ruckus Wireless access points and Wireshark in Community and Online Support Services

Capturing 802.11 frames with Ruckus Wireless access points and Wireshark

keith_redfield — Wed, 16 Apr 2014 19:36:50 GMT

Spotted on Twitter

Our Community Champ Primoz (@jazzycow81) just posted a very nice howto blog on setting up packet capture with Ruckus products and Wireshark. Have a look http://wlanimp.blogspot.com/2014/04/c...

It should be very helpful in troubleshooting wireless network issues.

BTW, we use Wireshark internally here and so attaching a trace to your case is a great way to accelerate resolution velocity

Re: Capturing 802.11 frames with Ruckus Wireless access points and Wireshark

primoz_marinsek — Thu, 17 Apr 2014 10:22:58 GMT

Thanks for the bump Keith :)

I've just modified the post a bit, so it now includes how to change channels on APs which is important when using an AP just to capture frames.

Re: Capturing 802.11 frames with Ruckus Wireless access points and Wireshark

alberto_de_la_c — Wed, 23 Apr 2014 06:53:09 GMT

Nice post Primoz!

I want to add that this remote capture feature only works with wireshark for windows (what is very annoying for me)

Re: Capturing 802.11 frames with Ruckus Wireless access points and Wireshark

alexandra_frinc — Thu, 01 May 2014 14:39:36 GMT

Indeed a useful post for Ruckus clients, thank you for your contribution.

You could also include some info on how to capture on the uplink of the AP (on eth0). Sometimes, when troubleshooting is useful to compare the traffic coming on the uplink of the AP with what it is actually sent on the air side.

Have you notice any impact of enabling packet capture on the AP stability?
I've seen APs crashing after enabling packet capture (whether if it was done from the ZD webUI or from the AP's CLI). We're trying to understand why.

Re: Capturing 802.11 frames with Ruckus Wireless access points and Wireshark

primoz_marinsek — Fri, 02 May 2014 10:10:07 GMT

Hi Alex

You could capture on the wired side also, but the intended topic of the post was how to capture packets from the air since you can do alot of troubleshooting that way.

I guess if there is any impact on AP stability it is down to some software bug rather than an overload due to the packet capture functionality in general. If capturing from a stand-alone AP I would suggest you use at least 7372 or better a 7982 AP for this since it is a 3x3 radio and the best hardware around so it shouldn't be a problem.

Re: Capturing 802.11 frames with Ruckus Wireless access points and Wireshark

alexandra_frinc — Fri, 02 May 2014 12:10:29 GMT

We actually experienced this behaviour with 7982's.
I look forward to receiving feedback from Support.

Re: Capturing 802.11 frames with Ruckus Wireless access points and Wireshark

yuk_ching_chow — Tue, 03 Feb 2015 04:01:46 GMT

We found that the setup is very useful for troubleshooting.
And it will be nice if Ruckus 11ac APs (eg r700) can support the packet capture mode as well.
We look forward to this.

Re: Capturing 802.11 frames with Ruckus Wireless access points and Wireshark

michael_brado — Tue, 03 Feb 2015 21:29:56 GMT

Expected for all .11ac APs in ZD version 9.10. (next release)

Re: Capturing 802.11 frames with Ruckus Wireless access points and Wireshark

yuk_ching_chow — Wed, 04 Feb 2015 02:25:59 GMT

Hi Michael

Thanks for the update.
How about for 11ac APs in SCG200 setup? Any roadmap?

Re: Capturing 802.11 frames with Ruckus Wireless access points and Wireshark

jan_fx — Mon, 20 Jun 2016 12:04:37 GMT

How do I setup a R710 wlan interface as a Monitor (MON) interface for remote packet capture?