Release Notes

Parameter Description
pause
Pause a packet capture session.
stop
Stop a packet capture session.
resume
Resume a packet capture session.
<pcap-id>
ID of the PCAP session.
Usage Guidelines
These commands direct an AP to send WiFi packet captures to a client packet analyzer utility such as Airmagnet,
Wireshark and so on, on a remote client.
Before using these commands, you need to start the packet analyzer utility on the client and open a capture
window for the port from which you are capturing packets. The packet analyzer cannot be used to control the
flow or type of packets sent from APs.
The packet analyzer processes all packets. However, you can apply display filters on the capture window to
control the number and type of packets being displayed. In the capture window, the time stamp displayed
corresponds to the time that the packet is received by the client and is not synchronized with the time on the
AP.
Filter specification (used in ap packet-capture interactive) supports the following:
- type (beacon/rts/cts/data/ack/ctrl/mgmt/all)
- sta (mac address)
- bss (mac address)
- da (mac address)
- sa (mac address)
- dir (tods, fromds)
- retry (1, 0)
- frag (1, 0)
- wep (1, 0)
Filter spec examples:
(type eq beacon) or ((sta eq 000000010203) and (dir eq tods))
(type == data) && ((sta = 000000010203) || (sta == 000000010203))
(type != beacon)
(wep nq 1)
(type eq all)
Examples
The following command starts a raw packet capture session for the AP ly115 on radio 0, and sends the packets
to the client at 10.64.102.4 on port 5000.
(host) (config) #ap packet-capture raw-start ap-name ly115 10.64.102.4 5000 0 radio 0
Packet capture has started for pcap-id:1
Dell Networking W-Series ArubaOS 6.4.x | Reference Guide ap packet-capture | 178