topic Re: TCPDUMP/Remote sniffer in cmd of AP in Aerohive Migrated Content

TCPDUMP/Remote sniffer in cmd of AP

patkszen — Wed, 11 Dec 2019 22:35:09 GMT

I need to capture some traffic over separate from our corp link therefore AP won't be able to talk to HM. What is the process of running remote sniffer from CMD on AP130?

Re: TCPDUMP/Remote sniffer in cmd of AP

samantha_lynn — Wed, 11 Dec 2019 22:52:01 GMT

You can initiate a remote sniffer packet capture on the CLI of the AP with the command: exec capt remote-s host-a [IP address of device running wireshark].

Is that what you were looking for?

Re: TCPDUMP/Remote sniffer in cmd of AP

patkszen — Thu, 12 Dec 2019 00:20:07 GMT

Yes this is it, I'll give it a go tomorrow. Thank you

Just out of curiosity, are there any other means of capturing traffic so that file is saved locally on the ap?

Re: TCPDUMP/Remote sniffer in cmd of AP

samantha_lynn — Thu, 12 Dec 2019 02:07:51 GMT

Yes, the commands should be:

capture save interface wifix <file name or remote location where the packet capture will be saved>

This first command sets where the pcap file is saved. For example, if we wanted to run one for wifi0, and we're saving to a tftp server, the command would looks something like this;

capture save interface wifi0 tftp://server:/path/filename

The next command is:

capture interface wifix

This will start the capture on the interface you choose, wifi0 or wifi1.

Re: TCPDUMP/Remote sniffer in cmd of AP

patkszen — Thu, 12 Dec 2019 16:38:04 GMT

Thanks, saved my day