On 19/08/2019 15:57, Richard Perlman
wrote:
Got it. Makes sense.
While my APs are in “bridge” mode, I do have switches
deployed in several locations, notably between the Mac I am
running Wireshark on and the rest of the network. I am not
exactly sure how, or with the equipment I have - if, I can set
up a span session. All the information on doing that seems to
assume Cisco gear. My network is fairly simple and consists of
Wi-Fi access points (mostly aging Apple Airports), Ethernet
switches and a gateway router provided by my ISP (
Free.fr in
France).
In any case, I at least know why I don’t see the
traffic.
There are other ways of doing that - but it will involve some
extra equipment:
1. A Small SoC computer can be set up as a router, potentially
capable of running tcpdump to take the packet captures.
2. A physical TAP on a port can make a copy of the traffic and
you can connect your kit running Wireshark to that.
3. Even a second hand Cisco switch can be purchased on eBay
pretty cheaply.
The SoC computer might be the cheapest option, I'm thinking
Raspberry Pi - this has wifi and a gigabit port, so could
temporarily replace your AP, and the Debian Based Raspbian
software can run wireshark, or you can run tcpdump and then
export the pcap to view in wireshark.
Second cheapest, although probably close in price would be a
used Cisco switch, anything in the Catalyst range would have the
span session capability: https://www.ebay.co.uk/itm/CISCO-CATALYST-3560-SERIES-PoE-24-WS-C3560-24PS-24-PORT-PoE-SWITCH-FREE-DEL/272243680614?epid=1017614211&hash=item3f62fce566:g:~2cAAOSwMwxbVg8k
- this is probably technically easier than the SoC option, but
does require some Cisco know-how.
The TAP option is probably the most expensive for an industrial
tap device, but it requires no technical know-how, just
connecting the AP or your gateway in line and connecting your
Wireshark device to the other port, there are only a few
(perhaps three) permutations where you can go wrong, and you'll
know if you've connected it up wrong (nothing works, and/or you
see no packets).
