Description
This document describes how to configure FortiAP as a sniffer to collect air packet capture.
Related links.
https://docs.fortinet.com/product/wireless-controller/8.5
Page# 502: https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/f8902d66-dfb2-11e9-8977-005056...
Solution
Below steps explain how to collect Wireless captures using the nearest sibling AP.
The sniffing FortiAP has to be near by the problem client and its associated AP within -60 dbm RSSI for better results.
1) Need to remove the ess-profile/vap entries from the sniffer FortiAP before starting the capture.
2) Commands to enable the sniffer:
After getting the captures, make sure to disable the sniffer and add the initially removed ess-ap-table entries back on the sniffer FortiAP.
From GUI.
Before starting the FortiAP packet capture, remove the ess-profile/VAP from the sniffer FortiAP.
Go to Configuration -> Devices -> AP Packet Capture and add a profile.
This document describes how to configure FortiAP as a sniffer to collect air packet capture.
Related links.
https://docs.fortinet.com/product/wireless-controller/8.5
Page# 502: https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/f8902d66-dfb2-11e9-8977-005056...
Solution
Below steps explain how to collect Wireless captures using the nearest sibling AP.
The sniffing FortiAP has to be near by the problem client and its associated AP within -60 dbm RSSI for better results.
1) Need to remove the ess-profile/vap entries from the sniffer FortiAP before starting the capture.
2) Commands to enable the sniffer:
wlc#conn ap <ap-id>3) Once capture is completed, stop the sniffer on the FortiAP by executing the below command.
ap-id>sniff destport 9177
ap-id>sniff destmode l3
ap-id>sniff destaddr <----- IP of the PC with Wireshark.
ap-id>sniff enable on all
ap-id>sniff enable off allNote.
After getting the captures, make sure to disable the sniffer and add the initially removed ess-ap-table entries back on the sniffer FortiAP.
From GUI.
Before starting the FortiAP packet capture, remove the ess-profile/VAP from the sniffer FortiAP.
Go to Configuration -> Devices -> AP Packet Capture and add a profile.
