CAPWAP (Control and Provisioning of Wireless Access Points) is a protocol that allows an access controller (AC) to manage a set of wireless endpoints. CAPWAP is defined in RFC 5415.
The IETF developed CAPWAP with three goals in mind:
To centralize authentication and policy enforcement functions in wireless networks
To move higher-level protocol processing away from access points
To provide an extensible protocol that could be used with various types of access points (APs).
When supported and enabled, the first function of CAPWAP is to initiate a discovery phase. Wireless access points search for a controller by sending discovery request messages. Upon receipt of a discovery request, the controller responds with a discovery response. At this point, the two devices establish a secure connection using the DTLS (Datagram Transport Layer Security) protocol to exchange control messages and CAPWAP data. Control messages contain information and instructions related to WLAN management, while data messages encapsulate transmitted wireless frames. Each is sent through a different User Datagram Protocol (UDP) port.
According to the IETF, CAPWAP supports two modes of operation: split MAC and local MAC.
In split MAC mode, the CAPWAP protocol encapsulates all wireless data and Layer 2 management frames, which are then exchanged between the controller and the access point.
In Local MAC mode allows data frames to be locally bridged or tunneled as Ethernet frames.
In either mode, the access point processes Layer 2 wireless management frames locally and then transmits them to the controller.
The protocol was also designed to support interoperability in a multi-vendor WLAN. Of the vendors that have implemented it, however, most have added proprietary extensions that prohibit interoperability.
Example below shows CAPWAP packets captured in with and AC and AP
Thanks
