No I’m afraid that AirPcap is not supported on OSX at the moment. See the FAQ from cacetech (Riverbed) here: http://www.cacetech.com/support/airpcap_faq.html#faq_12

I have not used Airmagnet so I can’t really compare them, but as you’ll see from many discussions of the pro’s and cons of each, the jury is still out. What I would say though is IF you are a Wireshark devotee, then AirPcap is developed to work with it. Riverbed Technology acquired cacetech and the staff work alongside the inventors or Wireshark and winpcap (Loris Degioanni and Gerald Combs) , who also work for Riverbed. See the video here:
http://mccltd.net/blog/?p=1116

Sorry I can’t be more specific. I have provided some links here. Please also note that AirPcap is also designed to work with Cascade Pilot (which opens huge Wireshark files, as demostrated here: http://www.youtube.com/watch?v=5TIASlFDLwQ ) to provide useful graphical tools and analyses of the data contained within the capture file. There’s a 30-day trial version of this software available on Riverbed’s website.

Airmagnet:
http://www.flukenetworks.com/enterprise-network/wireless-network/AirMagnet-WiFi-Analyzer

Cascade Pilot:
http://www.riverbed.com/us/contact/cascade-pilot-30-day-trial.php (complete the form and then a link to the software download is sent to you, with the 30-day licence key).

Video:
http://www.riverbed.com/us/media/demos_videos/product_demos/cascade_introduction.php
More videos:
http://www.riverbed.com/us/media/demos_videos/product_demos/

Sorry I couldn’t be more specific but I hope this helps anyway.
- Daren. (Riverbed employee)

Great stuff! Also, take a look at these examples (excuse the poor alignment) – one default and one non-default to see how mask is applied:

Default WCCP Mask:
Field………………………Mask (Hex)…………….Mask (Binary)
Source IP address………0000……………………0000000000000000
Dest. IP address………..1741……………………0001011101000001
Source Port………………0000…………………..0000000000000000
Dest Port…………………0000…………………..0000000000000000

Non-Default WCCP Mask:
Field……………………….Mask(Hex)…………….Mask (Binary)
Source IP address……….2480……………………0010010010000000
Dest. IP address…………0208……………………0000001000001000
Source Port………………0003……………………0000000000000011
Dest Port…………………0000……………………0000000000000000

So the pin-outs of the RJ-45 end are the same as the flat blue Cisco “rollover” cable. An RJ-45 to DB-9 convertor takes these “rolled” signals and places them onto these pins:

RJ-45 DB-9
1========>7
2========>4
3========>3
4========>5
5========>5
6<========2
7<========6
8<========8

The challenge then is taking the pinouts from one of the RJ-45 ends and converting the signals from Cisco’s rollover to a Null-modem configuration.

Cisco also sell some End connectors, one of which is the “CAB-25AS-FDTE”. I think that this convertor will change the rollover to connect to a DB-25 RS-232 DTE interface. The APC uses a DB-9 RS-232 DTE signalling, so my thought is that using the CAB-25AS-FDTE with a standard DB-9 to DB-25 convertor will work.

Please note though that this recommendation has not been proven and this advice is offered in good faith as best-effort.

This site was just what the Dr. ordered. Nice job in presenting the material. My 9211 had the passwords in the correct place. Once you break it, go here to upgrade to the last available firmware (not available from APC anymore :-(

Steelhead # tcpdump -i inpath0_0 -vvv (ip and (ip[1] & 0xfc) >> 2 == 20)

If your Steelhead uses more than one inpath interface, some of the packets may use one interface and the others a second. So, make sure that you open TWO cli sessions and write the capture to a pcap file:

Steelhead # tcpdump -i inpath0_0 -vvv (ip and (ip[1] & 0xfc) >> 2 == 20) -w cap-inpath-0.cap

Steelhead # tcpdump -i inpath0_0 -vvv (ip and (ip[1] & 0xfc) >> 2 == 20) -w cap-inpath-1.cap

Then open one file in Wireshark and then MERGE with the second capture.

Alternatively, use the “Custom Filter” field from the Web interface (Reports > diagnostics > tcpdump) and tick the lan0_0, wan0_0 and lan0_1 and wan0_1 interfaces. Again, once the capture is complete and you’ve downloaded the pcap files, open one and merge with the second.

service-policy policyname global

(I’m not the firewall admin, he just told me that’s what was needed)