Client Capture on the wireless

[jbuergmayr]

Hello,

I want to troubleshoot WLAN Client connection- and roaming-issues and need the packet capture filters to see all client relevant packets.

I tried

wlan src or dst <mac-addr>

but I see not all traffic

perhaps I ping the IP of this client and do not see the icmp packets.

I tried also

ip proto icmp

with and extra Meraki-AP on the same chanels but do not see the icmp packets

Best regards

Josef

[alemabrahao]

What interface are you trying?

MR - Access points

The following options are available for a packet capture on the MR:

• Access point: Select one or more access points to run the capture on.
• Capture type: Select the interface to run the capture on;
  • wired - captures wired/uplink traffic from one or more RJ45 ports on the Access point.
  • wireless - captures wireless traffic
  • LAN - on some access point models, such as the MR30H, you can capture traffic from four LAN access ports.
• Output: Select how the capture should be displayed; view output or download .pcap.
• Ignore: Optionally ignore capturing broadcast/multicast traffic.
• Filter expressions: Apply a capture filter.

The MR allows packet captures on its wired or wireless interface. Captures on the wireless interface are useful to troubleshoot issues when clients have connectivity issues to the access point.  Captures from the wired interface an offer insight into the access point's interaction with the LAN.

Note that packet captures taken on the wired interface of access points running MR 27.0+ firmware will not display 802.1q VLAN tags.

Note: The default behavior of client packet captures is to capture traffic sourcing from the client. If a bi-directional (to and from) capture from a specific source and destination is required, use this filter wlan addr1 <MAC> or wlan addr2 <MAC>. Addr1 and Addr2 represents source and destination respectively.

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Packet_Capture_Overvi...

[UKDanJones]

Don't filter anything on the capture. Filter it later in wireshark