Is there any way to identify/differentiate the requests from different APs?įor example, can I change the UDP port number from the default 5555 to something different for each APs? That way I can sniff multiple ports and map each port to a different AP. Boolean Can be 1 or 'True' or 'TRUE', 0 or 'False' or 'FALSE' (without quotes). As with unsigned integers you can use decimal, octal, hexadecimal or binary. Since we are getting the packets from WLC, we don't get the IP address of the AP, but the IP address of WLC as our source. The following display filters are equivalent: ip.len le 1500 ip.len le 02734 ip.len le 0x5dc ip.len le 0b10111011100 Signed integer Can be 8, 16, 24, 32, or 64 bits. The challenge we face is identifying individual APs from where the probes originated. If a name is used, both the port number and protocol are checked.

The port can be a number or a name used in /etc/services (see tcp (4P) and udp (4P)). We would like to extend the capture across multiple APs. True if the packet is ip/tcp, ip/udp, ip6/tcp or ip6/udp and has a destination port value of port. Currently, the architecture is setup as follows:ĪP sends wi-fi packets in sniffer mode to WLC, and WLC forwards it to wireshark. We setup wireshark to capture the wi-fi packets, and tested it against one AP. As they move, the probe requests will be captured from different APs. I am working on a project to understand customer movement/crowding by capturing wi-fi probe requests. IP traces record any IP stream, according to destination and/or source IP address, or port and Layer-4 protocol (UDP, TCP or any other IP type as defined by.

Wireshark filter udp port