Mist API Reference
Mist Automation Guide
HomeSDKsAPI ReferenceContext Plugin
UtilitiesPCAPs

startSitePacketCapture

POST
/api/v1/sites/{site_id}/pcaps/capture

Initiate a Site Packet Capture

The output will be available through websocket. As there can be multiple commands issued against the same AP at the same time and the output all goes through the same websocket stream, session is introduced for demux.

Subscribe to Device Command outputs

WS /api-ws/v1/stream

{    "subscribe": "/sites/{site_id}/pcaps"}

Response (MxEdge)

{    "event": "data"    "channel": "/sites/{site_id}/pcaps"    "data": {         "capture_id": "6b1be4fb-b239-44d9-9d3b-cb1ff3af1721",     "lost_messages": 0         "pcap_dict": {             "channel_frequency": 2412,             "channel": "1",             "datarate": "1.0 Mbps",             "rssi": -75,              "dst": "78:bd:bc:ca:0b:0a",             "src": "18:b8:1f:4c:91:c0",             "bssid": "18:b8:1f:4c:91:c0",             "frame_type": "Management",              "frame_subtype": "Probe Response",          "proto": "802.11",              "ap_mac": "d4:20:b0:81:99:2e",              "direction": "tx",              "timestamp": 1652246543,              "length": 416.0,             "interface": "radiotap",             "info": "1652246544.467733 1683216786us tsft 1.0 Mb/s 2412 MHz 11g -75dBm signal -82dBm noise antenna 0 Probe Response (ATTKmsWiVS) [1.0* 2.0* 5.5* 11.0* 18.0 24.0 36.0 54.0 Mbit] CH: 2, PRIVACY\\n",         },         "pcap_raw": "1MOyoQIABAAAAAAAAAAAAP//AAABAAAAEEh7Yh5VBwCgAQAAoAEAAAAAKwBvCADAAQAAAIw7reCS2VNkAAAAABACbAmABLWuAAEAEBgAAwACAABQADoBeL28ygsKGLgfTJHAGLgfTJHAcIZ2WDlBJQAAAGQAERUACkFUVEttc1dpVlMBCIKEi5YkMEhsAwECBwZVUyABCx4gAQAjAhkAKgEEMgQMEhhgMBQBAAAPrAQBAAAPrAQBAAAPrAIMAAsFAQAbAABGBTIIAQAALRqtCR////8AAAAAAAAAAAAAAAAAAAAAAAAAAD0WAggVAAAAAAAAAAAAAAAAAAAAAAAAAH8IBAAIAAAAAEDdkwBQ8gQQSgABEBBEAAECEDsAAQMQRwAQn2481frn3KT+uGod2ERx+RAhAAtBcnJpcywgSW5jLhAjAApCR1cyMTAtNzAwECQACkJHVzIxMC03MDAQQgAKQkdXMjEwLTcwMBBUAAgABgBQ8gQAARARAA5BcnJpcyBXaXJlbGVzcxAIAAIgCBA8AAEBEEkABgA3KgABIN0JABAYAgEQHAAA3RgAUPICAQGEAAOkAAAnpAAAQkNeAGIyLwAzjakr"}

Response (Wired)

{    "event": "data"    "channel": "/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps"    "data": {        "capture_id": "f039b1b4-a23e-48b2-906a-0da40524de73",         "pcap_dict": {             "dst_mac": "68:ec:c5:09:2e:87",             "src_mac": "8c:3b:ad:e0:47:40",              "vlan": 1,              "src_ip": "34.224.147.117",              "dst_ip": "192.168.1.55",             "dst_port": 51635,              "src_port": 443,             "proto": "TCP",              "ap_mac": "d4:20:b0:81:99:2e",             "direction": "tx",              "timestamp": 1652247615,              "length": 159.0,              "interface": "wired",             "info": "1652247616.007409 IP ec2-34-224-147-117.compute-1.amazonaws.com.https > ip-192-168-1-55.ec2.internal.51635: Flags [P.], seq 2192123968:2192124057, ack 4035166782, win 12, options [nop,nop,TS val 597467050 ecr 740580660], length 89\\n",             },         "pcap_raw": "1MOyoQIABAAAAAAAAAAAAP//AAABAAAAQEx7YhMzAACfAAAAnwAAAGjsxQkuh4w7reBHQIEAAAEIAEUAAI1bLEAAKAZ/CiLgk3XAqAE3AbvJs4KpKEDwg8I+gBgADFf9AAABAQgKI5yfqiwkXTQXAwMAVKY5JopoKQrVEn0/3ld4YntctGEH/rTZuwtCvzSncFw71QJveJi9uxHs57KC8w9Apph3YvXJrmWg7M37+o+YV0KH/xmr626s5Bkhb3QhKOu+NoNEmA=="    }}

Stop Response (Wired/Wireless)

{    "event": "data"    "channel": "/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps"    "data": {      "capture_id": "a2f7374d-6a70-41fd-8a3f-71e42573baaf",       "lost_messages": 0,      "pcap_dict": null    }}

Authorization

Authorization<token>

Preferred authentication method for automation and integrations. Send the API token in the HTTP Authorization header.

Format: Authorization: Token {apitoken}

Notes:

  • An API token generated for a specific admin has the same privileges as that admin
  • An API token is automatically removed if it is not used for more than 90 days
  • SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed.

In: header

Path Parameters

site_id*string
Formatuuid

Request Body

application/json

Request Body

Packet capture request payload for site-level captures

Initiate a Client Packet Capture

ap_mac?|

AP MAC address used to target the client packet capture

client_mac?|

Client MAC address, required if type==client; optional otherwise

duration?|

Packet capture duration, in seconds

Range60 <= value <= 86400
Default600
includes_mcast?boolean

Whether to include multicast traffic in the packet capture

Defaultfalse
max_pkt_len?|

Maximum number of bytes captured from each packet

Range64 <= value <= 1536
Default512
num_packets?|

Maximum number of packets to capture; use 0 for unlimited

Range0 <= value <= 10000
Default1024
ssid?|

Optional SSID filter for the packet capture

type*"client"

Packet capture type discriminator for client captures

Value in

  • "client"

Response Body

curl -X POST "https://example.com/api/v1/sites/000000ab-00ab-00ab-00ab-0000000000ab/pcaps/capture" \  -H "Content-Type: application/json" \  -d '{    "client_mac": "60a10a773412",    "duration": 600,    "includes_mcast": false,    "max_pkt_len": 128,    "num_packets": 100,    "type": "new_assoc"  }'
{  "ap_count": 3,  "aps": [],  "duration": 600,  "enabled": true,  "expiry": 1614886726.5411825,  "format": "stream",  "id": "a9a84e13-a714-b1eb-152f-a434416217d5",  "include_mcast": false,  "max_pkt_len": 68,  "num_packets": 100,  "org_id": "a9346fba-f920-e99a-cc51-2e8dcc57fa3c",  "raw": true,  "site_id": "67970e46-4e12-11e6-9188-0242ac110007",  "ssid": "",  "timestamp": 1614886126.5411825,  "type": "radiotap"}

getSiteCapturingStatus GET

Get Capturing status

stopSitePacketCapture DELETE

Stop current capture