Cisco AP Modes and CAPWAP: Local, FlexConnect, Monitor, Sniffer, Bridge

A lightweight access point does almost nothing on its own. It builds a CAPWAP (Control and Provisioning of Wireless Access Points) tunnel to a WLC (wireless LAN controller) and receives its configuration, RF settings, and often its client traffic path from there. The mode assigned to the AP decides what that tunnel is used for: serving clients, switching traffic locally at a branch, scanning the air full time, capturing frames for analysis, or bridging a wireless backhaul. Local mode is the default and the one most APs run.

CAPWAP

CAPWAP replaced Cisco’s earlier LWAPP and is defined in RFC 5415. It creates two tunnels between each AP and the controller:

• Control, UDP port 5246. Configuration, firmware push, RRM (radio resource management) instructions, client state, keepalives.
• Data, UDP port 5247. Client traffic encapsulated from the AP to the controller.

The control channel is protected with DTLS (Datagram Transport Layer Security) by default. Data-channel DTLS encryption is available but off by default, because encrypting every client frame a second time costs throughput on hardware that is already encrypting at the 802.11 layer.

Because the tunnel is IP-based, the AP and the controller do not have to sit in the same subnet or the same building. The AP obtains an address by DHCP, discovers the controller (DHCP option 43, DNS lookup of CISCO-CAPWAP-CONTROLLER, a broadcast on the local subnet, or a previously learned controller address), joins it, and downloads its configuration.

CAPWAP splits the 802.11 workload between the two devices. The AP keeps the real-time functions that cannot tolerate delay: beacons and probe responses, frame acknowledgements, encryption and decryption, and the buffering of frames for sleeping clients. The controller takes the rest: association and authentication, key management, mobility and roaming decisions, RRM, and security policy. This division is what the term split-MAC architecture refers to. What the controller does with the channel, power, and roaming half of that list is covered in radio resource management and client roaming.

Local mode

Local mode is the default. The radios serve clients, and every client frame is encapsulated and carried through the CAPWAP data tunnel to the controller, which puts it onto the wired network. This is centralized switching, and it is why the switch port in a local-mode deployment carries only CAPWAP traffic from a single IP address rather than the client VLANs themselves. That has a direct effect on how you wire the AP’s switch port.

A local-mode AP also spends a small slice of its time off-channel, roughly 50 milliseconds out of every 180 seconds, scanning other channels for rogue devices, interference, and neighbor information that RRM needs. Client service continues throughout.

Local mode assumes the controller is reachable with reasonable latency. If the AP loses the controller, it stops serving clients.

FlexConnect

FlexConnect exists for branch offices where the controller lives across a WAN link. Each WLAN is configured for either central switching (client traffic still tunnels to the controller) or local switching (the AP drops client traffic directly onto the branch’s wired VLANs). Authentication can likewise be central or local. The switching choice is one setting on the WLAN itself, alongside the SSID, interface mapping, and security policy set when building a WLAN on the controller.

The mode’s behavior splits into two states:

• Connected mode. The controller is reachable. The AP takes configuration and policy from it, and locally switched WLANs still put traffic straight onto the branch LAN.
• Standalone mode. The controller is unreachable. WLANs configured for local switching with local authentication keep serving clients, so branch staff can keep working and reach branch resources. WLANs that depend on central switching are brought down, because there is no tunnel to carry their traffic. Clients that require central authentication cannot be authenticated while the controller is missing.

Because a FlexConnect AP with locally switched WLANs places tagged client traffic onto the wire itself, its switch port requirements differ from a local-mode AP.

Monitor, sniffer, rogue detector, and the rest

Mode	Serves clients	Radio use	Use it when
Local	Yes	Client service, brief off-channel scans	Standard campus coverage with centralized switching
FlexConnect	Yes	Client service, local or central switching	Branch site behind a WAN link that must survive an outage
Monitor	No	Receive only, scans all channels continuously	Dedicated rogue detection, wIPS, or location tracking
Sniffer	No	Captures 802.11 frames on one channel	Wireless packet capture sent to a remote analyzer
Rogue detector	No	Radio disabled	Correlating rogue MAC addresses seen in the air against the wired network
Bridge / Mesh	Yes on mesh APs	Wireless backhaul plus optional client service	Linking buildings or covering outdoor areas without cabling
SE-Connect	No	Dedicated to spectrum analysis	Hunting non-Wi-Fi interference with a spectrum analyzer

A few details behind the table:

• Monitor mode dedicates the AP to listening. It cycles through every channel rather than dwelling on one, which makes it much better at catching a rogue that appears briefly than a local-mode AP performing occasional off-channel scans. It costs you an AP’s worth of capacity.
• Sniffer mode turns the AP into a remote capture probe. It is pointed at a single channel and forwards captured 802.11 frames to a workstation running an analyzer such as Wireshark, which decodes them from the encapsulation the AP applies. This is how you see management and control frames that a wired capture can never show.
• Rogue detector mode does not use the radio at all. The AP connects to a trunk port and watches the wired side, comparing MAC addresses learned from ARP traffic against the rogue MAC addresses the rest of the wireless infrastructure reports. A match tells you the rogue is plugged into your network rather than being a neighbor’s AP across the street. This mode has been removed from newer controller software but remains in exam scope.
• Bridge and mesh mode builds wireless backhaul. A RAP (root AP) has a wired connection to the network, and one or more MAPs (mesh APs) reach it over the air, selecting parents with Cisco’s AWPP (Adaptive Wireless Path Protocol). Flex+Bridge adds FlexConnect’s local switching to a mesh AP.
• SE-Connect mode, short for Spectrum Expert Connect, dedicates the radio to raw spectrum sampling and streams the data to a spectrum analysis application. It finds the sources that Wi-Fi tools cannot see, such as a microwave oven, a video bridge, or a cordless phone.

Cisco also offers a sensor mode on specific hardware, where the AP behaves as a test client and runs synthetic connectivity tests for assurance platforms.

How the 200-301 exam tests this

• Port numbers. A question asks which UDP ports carry CAPWAP, or which of the two channels is encrypted by default. Control is 5246 and DTLS-protected, data is 5247 and unencrypted unless enabled.
• Branch survivability. A scenario describes a remote site whose WAN link to the controller is unreliable and requires that wireless users keep working during an outage. FlexConnect with local switching and local authentication is the answer, and local mode is the trap.
• Choosing a diagnostic mode. A scenario needs a wireless packet capture on one channel (sniffer), continuous full-time rogue scanning (monitor), or the source of interference that no client can decode (SE-Connect). The discrimination is between capturing frames, watching for rogue SSIDs, and analyzing raw RF energy.
• Split-MAC responsibilities. A question lists functions and asks which the AP performs and which the controller performs. Beaconing, acknowledgements, and encryption stay on the AP; association, authentication, and RRM sit on the controller.

The mode-to-scenario mapping is the whole game here, and it is exactly the kind of discrimination practice questions build faster than rereading a table.

Quick reference

• CAPWAP control uses UDP 5246 and is DTLS-encrypted by default; CAPWAP data uses UDP 5247 and is not encrypted unless you enable it.
• Local mode is the default: clients are served and all client traffic tunnels back to the controller.
• FlexConnect connected mode follows controller policy; standalone mode keeps locally switched and locally authenticated WLANs alive and drops centrally switched ones.
• Monitor mode serves no clients and scans all channels for rogues, wIPS, and location.
• Sniffer mode captures 802.11 frames on one channel and forwards them to a remote analyzer.
• Rogue detector mode disables the radio and listens on a wired trunk to determine whether a rogue is on your network.
• Bridge and mesh mode uses a wired RAP and wireless MAPs joined by AWPP.
• SE-Connect dedicates the radio to spectrum analysis and serves no clients.
• The controller side of this design is covered in WLC ports and interfaces.