loader-logo

Capture Ruckus Wireless AP Packets with Wireshark

Have you ever needed to get more detailed in your troubleshooting of wireless networks that you had to get down to the packet level? Sometimes seeing the raw packets in Wireshark gives us all we need to diagnose a problem.

With Ruckus Wireless you can enable two kinds of packet captures straight from the web interface of the Ruckus ZoneDirector.

  • Local
  • Stream

Both modes can be selected from the AP in which you will be capturing packets. Local mode will capture packets two and from the AP and store that capture locally. You then download the capture file and open it in Wireshark.

The streaming mode allows you to use Wireshark as a remote capture. The AP streams all the packets to your laptop!

In this post I will show you how to enable packet capture mode in the Ruckus ZoneDirector for a specific AP and then stream those packets to my laptop which will be running Wireshark.

[adrotate banner=”29″]

To start capturing packets on a Ruckus AP, first log into the ZoneDirector and click on the Administer tab. Then on the left navigation click on Diagnostics.

ZoneDirector

Near the bottom of that window you will see a section labeled Packet Capture. First, select which band you want to capture on, 2.4GHz or 5GHz. Then, we will select the APs we want to run in capture mode. You can select more than one AP and do a quick search if you have many APs. Check the box next to the AP you want to capture packets on and then click on Add to Capture APs.

Packet Capture Options

Each AP you add to Capture APs will show on the right side. The result is removed from the list of available APs on the left.

To begin capturing packets, select the checkbox for the AP and then select either Local Mode or Streaming Mode. In this select I chose Streaming Mode.

Then click on Start.

Packet Analysis

Now this is where it begins to get interesting.This remote capture is only available on Microsoft Windows because it uses WinPcap. The target location (Ruckus AP) will be running Remote Packet Capture Protocol. Open Wireshark and hit CTRL-K on the keyboard to bring up your Capture Options. Then click on Manage Interfaces.

Select from the interfaces provided

When Interface Management opens up click on the Remote Interfaces tab and click Add. Here you will type in the Host IP address of the Ruckus AP you selected to become a Capture AP.

Leaving the Port field blank will default to port 2002. All other fields can remain at its default option.

Type in the remote target IP address

After you hit OK it will add all of the Ruckus APs interfaces to the Capture Options list. Enable and disable the Capture on all interfaces to uncheck everything. Enable the interface with wlan100 for 2.4GHz, or if you selected 5GHz look for wan101.

2.4GHz on wlan100 interface

Once you start the capture you will get a stream of packets from the Ruckus AP.

Wireshark captured packets

How are you using Wireshark to troubleshoot wifi?

Previous Article


One thought on “Capture Ruckus Wireless AP Packets with Wireshark”


[gravityforms id=16 title=false description=false]
<script type="text/javascript">if(!gform){document.addEventListener("gform_main_scripts_loaded",function(){gform.scriptsLoaded=!0}),window.addEventListener("DOMContentLoaded",function(){gform.domLoaded=!0});var gform={domLoaded:!1,scriptsLoaded:!1,initializeOnLoaded:function(o){gform.domLoaded&&gform.scriptsLoaded?o():!gform.domLoaded&&gform.scriptsLoaded?window.addEventListener("DOMContentLoaded",o):document.addEventListener("gform_main_scripts_loaded",o)},hooks:{action:{},filter:{}},addAction:function(o,n,r,t){gform.addHook("action",o,n,r,t)},addFilter:function(o,n,r,t){gform.addHook("filter",o,n,r,t)},doAction:function(o){gform.doHook("action",o,arguments)},applyFilters:function(o){return gform.doHook("filter",o,arguments)},removeAction:function(o,n){gform.removeHook("action",o,n)},removeFilter:function(o,n,r){gform.removeHook("filter",o,n,r)},addHook:function(o,n,r,t,i){null==gform.hooks[o][n]&&(gform.hooks[o][n]=[]);var e=gform.hooks[o][n];null==i&&(i=n+"_"+e.length),null==t&&(t=10),gform.hooks[o][n].push({tag:i,callable:r,priority:t})},doHook:function(o,n,r){if(r=Array.prototype.slice.call(r,1),null!=gform.hooks[o][n]){var t,i=gform.hooks[o][n];i.sort(function(o,n){return o.priority-n.priority});for(var e=0;e<i.length;e++)"function"!=typeof(t=i[e].callable)&&(t=window[t]),"action"==o?t.apply(null,r):r[0]=t.apply(null,r)}if("filter"==o)return r[0]},removeHook:function(o,n,r,t){if(null!=gform.hooks[o][n])for(var i=gform.hooks[o][n],e=i.length-1;0<=e;e--)null!=t&&t!=i[e].tag||null!=r&&r!=i[e].priority||i.splice(e,1)}}}</script> <div class='gf_browser_unknown gform_wrapper gravity-theme' id='gform_wrapper_16' ><form method='post' enctype='multipart/form-data' id='gform_16' action='/capture-ruckus-wireless-ap-packets-with-wireshark/' > <div class='gform_body gform-body'><div id='gform_fields_16' class='gform_fields top_label form_sublabel_below description_below'><fieldset id="field_16_1" class="gfield gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible" ><legend class='gfield_label gfield_label_before_complex' >Name<span class="gfield_required"><span class="gfield_required gfield_required_text">(Required)</span></span></legend><div class='ginput_complex ginput_container no_prefix has_first_name no_middle_name no_last_name no_suffix gf_name_has_1 ginput_container_name' id='input_16_1'> <span id='input_16_1_3_container' class='name_first' > <input type='text' name='input_1.3' id='input_16_1_3' value='' aria-label='First name' aria-required='true' placeholder='First Name' /> <label for='input_16_1_3' >First</label> </span> </div></fieldset><div id="field_16_2" class="gfield gfield--width-full gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible" ><label class='gfield_label' for='input_16_2' >Email<span class="gfield_required"><span class="gfield_required gfield_required_text">(Required)</span></span></label><div class='ginput_container ginput_container_email'> <input name='input_2' id='input_16_2' type='text' value='' class='large' placeholder='Business email address' aria-required="true" aria-invalid="false" /> </div></div><fieldset id="field_16_3" class="gfield gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible" ><legend class='gfield_label gfield_label_before_complex' >Consent<span class="gfield_required"><span class="gfield_required gfield_required_text">(Required)</span></span></legend><div class='ginput_container ginput_container_checkbox'><div class='gfield_checkbox' id='input_16_3'><div class='gchoice gchoice_16_3_1'> <input class='gfield-choice-input' name='input_3.1' type='checkbox' value='I consent to the processing and sharing with partners of the personal data that I provide Packet 6 for this activity in accordance with and as described in the &lt;a href=&quot;https://packet6.com/privacy-policy&quot; target=&quot;_new&quot;&gt;Privacy Policy&lt;/a&gt;' id='choice_16_3_1' /> <label for='choice_16_3_1' id='label_16_3_1'>I consent to the processing and sharing with partners of the personal data that I provide Packet 6 for this activity in accordance with and as described in the <a href="https://packet6.com/privacy-policy" target="_new">Privacy Policy</a></label> </div></div></div></fieldset><div id="field_16_4" class="gfield gform_validation_container field_sublabel_below field_description_below gfield_visibility_visible" ><label class='gfield_label' for='input_16_4' >Comments</label><div class='ginput_container'><input name='input_4' id='input_16_4' type='text' value='' /></div><div class='gfield_description' id='gfield_description_16_4'>This field is for validation purposes and should be left unchanged.</div></div></div></div> <div class='gform_footer top_label'> <input type='submit' id='gform_submit_button_16' class='gform_button button' value='Get the report' onclick='if(window["gf_submitting_16"]){return false;} window["gf_submitting_16"]=true; ' onkeypress='if( event.keyCode == 13 ){ if(window["gf_submitting_16"]){return false;} window["gf_submitting_16"]=true; jQuery("#gform_16").trigger("submit",[true]); }' /> <input type='hidden' class='gform_hidden' name='is_submit_16' value='1' /> <input type='hidden' class='gform_hidden' name='gform_submit' value='16' /> <input type='hidden' class='gform_hidden' name='gform_unique_id' value='' /> <input type='hidden' class='gform_hidden' name='state_16' value='WyJbXSIsImY4MGVlNTA5MGVjMWYzYzU5NzUyOGFhOWE3ZGFiMzRlIl0=' /> <input type='hidden' class='gform_hidden' name='gform_target_page_number_16' id='gform_target_page_number_16' value='0' /> <input type='hidden' class='gform_hidden' name='gform_source_page_number_16' id='gform_source_page_number_16' value='1' /> <input type='hidden' name='gform_field_values' value='' /> </div> </form> </div>