3Com WX2200 3CRWX220095A, WXR100 3CRWXR10095A Filter operates until you manually disable it

Remotely Monitoring Traffic 643

Enabling or Disabling A snoop filter does not take effect until you enable it. To enable or disable a Snoop Filter a snoop filter, use the following command:

set snoop {filter-nameall} mode {enable disable}

The filter operates until you manually disable it.

The filter mode is retained even if you disable and reenable the radio, or restart the MAP or the WX switch. Once the filter is enabled, you must use the disable option to disable it.

The following command enables snoop filter snoop1:

WX# set snoop snoop1 mode enable success: filter 'snoop1' enabled

Displaying Remote The MAP collects statistics for packets that match the enabled snoop Traffic Monitoring filters mapped to its radios. The MAP retains statistics for a snoop filter

Statistics until the filter is changed or disabled. The MAP then clears the statistics.

To display statistics for packets matching a snoop filter, use the following command:

display snoop stats [filter-name[apnumber [radio {1 2}]]]

The following command shows statistics for snoop filter snoop1:

WX# display snoop stats snoop1		Tx Match	Dropped
Filter	Ap Radio Rx Match

============================================================

snoop1 3 1 96 4 0

Preparing an

Observer and

Capturing Traffic

To observe monitored traffic, install the following applications on the observer:

„Ethereal or Tethereal Version 0.10.8 or later

„Netcat (any version), if not already installed

Ethereal and Tethereal decode 802.11 packets embedded in TZSP without any configuration.