sundance-communications.com/forum Forums VOIP Phones & IP PBX Networking How to sniff traffic to and from an wireless AP?

First I thought inserting a network tap/hub or my 5-port switch with pre-configured port mirroring should do the job. but now I understand that the packets in and out of the AP (thin or thick AP) may be encrypted, or may not be in Ethernet format.

So my questions are:

1) Is it true that the packets in and out of an AP amy not be in Ethernet format?

2) Any comments on how to sniff AP traffic?

The ethernet side of a WAP will not be encrypted. The wireless side is a few orders of magnitude harder to 'sniff' and probably is not what you want to do anyways.

The only time I've ever seen an encrypted WAP was when it was a managed RF node and had to be hard-wired into a 'controller', which was basically a fancy switch with VPN and a mesh networking management.

I would just throw a hub between the AP and Switch and fire up wireshark to see what is coming down the line. I can't imagine you have a real need to sniff the actual RF.

As Kumba said, wireshark is your friend. But if you really must sniff the RF stream, google is your friend, just be ready for a lot of noise in the search results. Reams have been written about it - that magazine whose name is a number comes to mind......

Also the folks who make wireshark have a commercial product available for this as well.

Jim
*************************************************
Still clutching my 2500 set and refusing to let go.