Viewing Wireless Traffic

Sniffer Mode AP
To convert UDP traffic into client traffic you have to decode frames as PeekRemote. Another step has to be taken to decode the traffic now. Preferences > Protocol > IEEE 802.11 > Choose type and enter the ssid password.

WLC to FTP Server
To view client traffic again you will probably need to go to references > Protocol > IEEE 802.11 > Check Ignore the Protection bit Yes – without IV



Some Common Filters Address Filter ip.addr ==
Conversation Filter ip.addr== && ip.addr==
TCP Port Filter tcp.port==
DNS Not Resolved Filter dns.flags.rcode != 0
Noise Filter !(arp or icmp or stp)
Time Between Packet Filter tcp.time_delta > .200
Why So Slow Filter tcp.analysis.flags && !tcp.analysis.window_update

Mike has a really nice frame header packet available for download.
Laura has a profile available for download.