Contents

Packet capture commands· 1

display packet-capture status· 1

packet-capture local ap· 1

packet-capture remote ap· 3

packet-capture stop· 3

 

Packet capture commands

A CF card is used as an example in this chapter. For information about the storage media supported by the device, see file system management in Fundamentals Configuration Guide.

display packet-capture status

Use display packet-capture status to display packet capture status information.

Syntax

display packet-capture status

Views

Any view

Predefined user roles

network-admin

Examples

# Display packet capture status information for radio 1 of AP 1.

<Sysname> display packet-capture status

AP name        : ap1

Radio ID       : 1

Radio mode     : 802.11n(2.4GHz)

Channel        : 1

Status         : Capturing

File name      : database.dhcp

Username       : 1

Password       : ******

Table 1 Command output

Field	Description
Status	Packet capture status. Only the Capturing status is supported in the current software version.
Username	Username for logging in to the remote FTP server.
Password	Password for logging in to the remote FTP server. Both ciphertext and plaintext passwords are displayed as ******. If no password is required or configured, this filed displays N/A.

 

Related commands

·     packet-capture local ap

·     packet-capture remote ap

packet-capture local ap

Use packet-capture local ap to capture incoming packets on an AP radio and save the captured packets to a file on an FTP server.

Syntax

packet-capture local ap ap-name radio radio-id [ capture-filter capt-expression | limit-frame-size bytes | autostop filesize kilobytes | autostop duration seconds ] * write url url [ username username [ password { cipher | simple } key ] ]

Views

User view

Predefined user roles

network-admin

Parameters

ap-name: Specifies an AP by its name, a case-insensitive string of 1 to 64 characters.

radio radio-id: Specifies a radio by its ID.

capture-filter capt-expression: Specifies an expression to match packets to be captured. If you do not specify a capture filter expression, the device captures all incoming packets on an interface.

limit-frame-size bytes: Sets the maximum number of bytes to capture for a packet. The value range is 64 to 8000 bytes, and the default value is 8000 bytes.

autostop filesize kilobytes: Stops capturing packets if the maximum packet file size is exceeded when file rotation is disabled. The kilobytes argument sets the maximum packet file size. The value range is 1 to 65536 kilobytes. If you do not set a limit, the packet file size is unlimited.

autostop duration seconds: Stops capturing packets when the capturing duration expires. The seconds argument sets the capturing duration. The value range is 1 to 2147483647 seconds. If you do not set a limit, the capturing duration is unlimited.

write url url: Specifies the URL of the packet file on an FTP server to store captured packet data. The URL must be a case-sensitive string of 1 to 255 characters. The URL string must not contain at signs (@), and the specified username and password. If you do not specify a URL, the captured packet data is not saved.

username username: Specifies the username for logging in to the FTP server. The username is a case-sensitive string of 1 to 32 characters.

password: Specifies the password for logging in to the FTP server.

cipher: Specifies a ciphertext password.

simple: Specifies a plaintext password.

key: Specifies the password. This argument is case sensitive. If simple is specified, it must be a string of 1 to 32 characters. If cipher is specified, it must be a ciphertext string of 1 to 73 characters.

Usage guidelines

To stop the capture while it is capturing packets, use the packet-capture stop command.

If you configure both the autostop filesize option and autostop duration option, the packet capture stops when any one of the limits for the stop options is reached.

Follow these restrictions and guidelines to specify the URL, username, and password:

·     If the IP address of the FTP server is an IPv4 address, enter URL in the format of ftp://FTP server IPv4 address[:port number]/file name.

·     If the server address is an IPv6 address, enclose the address in a pair of brackets, and enter URL in the format of ftp://[FTP server IPv6 address][:port number]/file name.

·     You can also specify the DNS domain name for the server address field. The URL format is ftp://DNS domain name/file name.

·     The username and password must be the same as those configured on the FTP server. If the server authenticates only the username, the password can be omitted.

Do not set a short capturing duration in the autostop duration seconds option. If the duration is too short, the capture might stop when a user has not logged in to the FTP server. The captured packets cannot be saved because a packet file has not been created.

Examples

# Capture incoming packets on radio 1 of AP 1.

<Sysname> packet-capture local ap ap1 radio 1 write url ftp://10.1.1.1/database.pcap username 1 password simple 1

Related commands

·     display packet-capture status

·     packet-capture stop

packet-capture remote ap

Use packet-capture remote ap to capture incoming packets on an AP radio.

Syntax

packet-capture remote ap ap-name radio radio-id [ port port ]

Views

User view

Predefined user roles

network-admin

Parameters

ap-name: Specifies an AP by its name, a case-insensitive string of 1 to 64 characters.

radio radio-id: Specifies a radio by its ID.

port port: Specifies the RPCAP service port on the AP by its port number. If you do not specify a RPCAP service port, RPCAP service port 2002 is used.

Usage guidelines

After this command is executed, the client (such as Wireshark) connected to the RPCAP service port of the AP can obtain packets captured on the AP radio.

To stop the capture while it is capturing packets, use the packet-capture stop command.

Examples

# Capture incoming packets on radio 2 of AP 1 and specify the RPCAP service port number as 2014.

<Sysname> packet-capture remote ap ap1 radio 2 port 2014

Related commands

·     display packet-capture status

·     packet-capture stop

packet-capture stop

Use packet-capture stop to stop the packet capture.

Syntax

packet-capture stop

Views

User view

Predefined user roles

network-admin

Usage guidelines

When a local AC on a hierarchical network goes offline, the central AC stops the packet capture management processes for the APs connected to the local AC. However, packet capture on the APs continues. To stop the packet capture, you must enable packet capture on the central AC for the APs again and execute this command.

Examples

# Stop the packet capture.

<Sysname> packet-capture stop

Related commands

·     packet-capture local ap

·     packet-capture remote ap