When I use sniffing on a wireless interface on my RBD52G-5HacD2HnD (hAP ac2) it disconnects all clients and stops sending beacons. I.e, it drops the wifi network. That seems totally useless, I wanted to see the packets it sends/receives at the Wifi level, with ACKs, retransmissions, beacons, etc. Is there a trick?
you can’t run sniffer AND normal operation (ap/station) at the same time on single interface. That simply contradicts how these things work.
****To be precise, all (unless I missed some) debugging features from
/interface wireless
(
sniffer
,
snooper
,
scan
(unless you select background=yes),
spectral-scan
,
spectral-history
,
align
,
frequency-monitor
) will disable normal radio operations.
****If you want to sniff data which goes through your radio, you can use either
/tool sniffer interface=YOUR_WLAN_INTERFACE
or for continuous sniffing you can also use
/ip firewall mangle action=sniff-tzsp
but that will be more complicated to setup as it depends on other setting and it will require another device to capture TZSP packets
If you want to sniff all data from the air (not just your network) then you cannot use radio which is already in operation - You can either use another radio in your existing device (for example if you can add more wlan interfaces with miniPCIE cards) or install separate device solely for this purpose.
****edit: sorry, I missed your last sentence about sniffing all frames (beacons, re-transmissions etc..) from your network - In that case you will still need another device as far as I know. (neither
/tool sniffer
or
mangle action=sniff-tzsp
will capture frames). Hopefully someone else will confirm it or bring another idea