Wireless Access

I've found that the local-filesystem is capped out at about 10MB max for a packet-capture.  I'd like to send my packet-capture data to a remote server.  I set the destination to the ip-address of a computer running WireShark but I would like to set a capture filter to only capture the remote traffic.  

I've read in various places that the protocol for this remote packet-capture data is called Aruba ERM (Encapsulated Remote Mirroring) and uses UDP port 5555.  My capture filter is "udp port 5555" but I'm not getting any traffic.  

I've confirmed that the device is online, if I set the destination to local-filesystem I'm getting captured packets so I know that the packet-capture is working.  

You'll need to configure Wireshark to use Aruba ERM port. The below guide is slightly old but still relevant on how to configure Wireshark.

https://community.arubanetworks.com/t5/Controller-less-WLANs/How-to-configure-wireshark-to-receive-packet-capture-from/ta-p/180448

It turns out when you take a pakcet capture from a controller it is *not* ERM encapsulated.  It is GRE encapsulated.  The capture filter I'm not using successfully is "ip proto 0x2f".  I'm sure it could be refined to a particular source address or other parameters as well, but this is the only GRE traffic on my monitoring endpoint so this filter is sufficient.

I'm not sure why this isn't documented anywhere currently.  The TAC engineer I spoke to is going to document it internally as well as here on AirHeads, but I thought I would post it too in case it helps someone else.