Hi there
I’m diving into network packet capture for some upcoming development work and found the option in ubiquiti UniFi Access Points (UAP), U6 Lite in my case, to ssh in and run a tcpdump session, which is nice and I stream the output via ssh to my local wireshark session. Ubiquity Documentation discusses the options.
Now I noticed that the capture works fine as long as the traffic goes across interfaces (wire/SDD or SSID/SSID) but traffic is not captured if it goes between two wireless hosts on the same SSID. I tried capturing both br0 or the SSID individual interfaces. Obviously it would be nicer to see all traffic that goes via this AP, even if it stays on the SSID. I expect some HW offloading to be to blame. I have workarounds for my used case but it peaked my interest and I’m interested if there is somebody that has insight or some information to contribute. Maybe a way to temporary disable HW offloading if it actually is to blame?
I only found very little results to my question in the ubiquity community area (here and here) but both are left without response.
First time poster, hope topic is to code. My online research might well be flawed and the answer is already out there. Glad to accept feedback on posting or packet capture. 