AP in sniffer mode in Cisco 9800

When a Cisco AP joins a WLC it can work in several modes, one of those being the "sniffer". In this mode, the AP will be passively listening to wireless traffic which can be sent to a device that can capture and analyze this traffic using an application like Wireshark.

Setting the AP in Sniffer mode

Converting the AP to Sniffer mode

On our Cisco 9800 WLC we have to navigate to Configuration->Wireless->Access Points

From the list of APs we will select the Access Point we want to be in Sniffer Mode, then in the "General" tab, we will select "Sniffer" and "Update and apply to device".

The AP will then reboot and re-join the WLC after a few minutes

Setting parameters in Sniffer mode

Once the AP has re-joined, we can verify its current mode. We will also notice that no channel is configured to be "sniffed"

 For configuring what channels are going to be sniffed, we have to individually go to each radio and select the channel and width, and the device where the captures are going to be collected. My laptop with Wireshark installed is in IP 172.20.20.193:

Configuring Wireshark to collect the captures

Capturing the packets

On our listening device, with Wireshark installed, we will start the capture, but before doing that, to have a cleaner capture, we will configure a capture filter allowing only packets to UDP port 5555

As soon as we start the capture we will see those packets being received in our Wireshark

Decoding the packets

At this point you may be wondering where are the Wi-Fi frames, you can only see UDP packets. By default Wireshark will decode UDP to port 5555 as SIGCOMP and you need to change that to be decoded as PEEKREMOTE. 

To do this you have to right click on any of the captured packets, go to "Decode As", change the value to PEEKREMOTE and apply

Once is applied, you will see how the packet that previously was showing only UDP protocol with "data" in it, is now decoded and shows what we expect from a OTA Wireless capture:

I hope this helps ;)