AirMagnet WiFi With a USB Adapter... Finally!
AirMagnet WiFi Analyzer has long been one of the premier WiFi sniffers. Up until recently, however, you pretty much had to have a laptop with a PC card slot if you were going to use it to it's full potential. Now Fluke Networks has released AirMagnet WiFi Analyzer 8.6, which supports the Ubiquiti SR71-USB dual-band 802.11n USB adapter.
If you've read this blog before (or if you've just looked at the About Me over there on the left), you know that I'm a big fan of WildPackets OmniPeek for WiFi sniffing. One reason is that it's a great product with tons of way to manipulate sniffed WiFi frames in order to get the statistical information you need. Another, though admittedly less important, reason is that they have had (at least until now) the best adapter support. The Linksys WUSB600N is a dual-band 802.11n USB adapter that is cheap (about $75) and versatile sniffing any type of 802.11a/b/g/n traffic. Wireshark may have the AirPcap NX, but it's expensive ($699). AirMagnet had the AirMagnet PC Card, but it's not very versatile (only works w/ AM; not USB form factor).
While I was on the AirMagnet site last week downloading some license updates for a couple of classes that I manage I noticed that version 8.6 of AirMagnet WiFi Analyzer was now available. Ever the optimist, I went over to the list of supported adapters on the site hoping for a change and there it was: the Ubiquiti SR71-USB.
The SR71-USB is very similar to the Linksys WUSB600N that can be used with WildPackets OmniPeek, but there are a few key advantages. The biggest advantage is that it has a detachable antenna interface. There are MMCX interfaces for both the 2.4 GHz and 5 GHz frequency bands. For normal sniffing I actually don't like using directional antennas because they give you a distorted view compared to what a typical station sees. Still, it is nice to have the option because if you are using your sniffer to find a rogue AP then you can rig up a directional antenna and track in the direction where the signal is highest. The other advantage of the SR71-USB is that it has a higher transmit power and lower receive sensitivity. That can be especially nice for demodulating frames from greater distances when you're looking for interfering WiFi devices. (And if you're curious about the exact specs, here they are for the WUSB600N and the SR71-USB.)
Though the SR71-USB does cost more than the WUSB600N (I paid $125 + shipping for mine), I think the aforementioned advantages make it worth the extra cost. And that leads me to my next topic: why the heck doesn't WildPackets support the SR71-USB for OmniPeek? The SR71-USB uses the Atheros AR9280 chipset. WildPackets has a long and glorious history of support for adapters that use Atheros chipsets, so support for the SR71-USB would seem like a no-brainer. Yet, when I look at the WildPackets drivers list the most recent Atheros driver that I see support for is the AR5008.
I do expect that WildPackets will soon support the SR71-USB for use with OmniPeek. And when they do that adapter will become the clear choice for people interested in professional-grade WiFi sniffing. Until then, people like me who use both AirMagnet WiFi Analyzer and WildPackets OmniPeek are going to have to continue carrying around two adapters.
My last note for this post is that I realize that I have a backlog of topics to discuss on the Sniff WiFi blog and I want to get to them soon. I still have to sniff the Verizon MiFi 2200 and I still want to give a rundown of the actual sniffing experience using the SR71-USB with AirMagnet. Also, I want to do a piece on using OmniPeek to ferret out the reasons for connection problems when you're using WPA/WPA2 Enterprise. I hope to cover at least one of those things before the end of 2009, so check back next week.
If you've read this blog before (or if you've just looked at the About Me over there on the left), you know that I'm a big fan of WildPackets OmniPeek for WiFi sniffing. One reason is that it's a great product with tons of way to manipulate sniffed WiFi frames in order to get the statistical information you need. Another, though admittedly less important, reason is that they have had (at least until now) the best adapter support. The Linksys WUSB600N is a dual-band 802.11n USB adapter that is cheap (about $75) and versatile sniffing any type of 802.11a/b/g/n traffic. Wireshark may have the AirPcap NX, but it's expensive ($699). AirMagnet had the AirMagnet PC Card, but it's not very versatile (only works w/ AM; not USB form factor).
While I was on the AirMagnet site last week downloading some license updates for a couple of classes that I manage I noticed that version 8.6 of AirMagnet WiFi Analyzer was now available. Ever the optimist, I went over to the list of supported adapters on the site hoping for a change and there it was: the Ubiquiti SR71-USB.
The SR71-USB is very similar to the Linksys WUSB600N that can be used with WildPackets OmniPeek, but there are a few key advantages. The biggest advantage is that it has a detachable antenna interface. There are MMCX interfaces for both the 2.4 GHz and 5 GHz frequency bands. For normal sniffing I actually don't like using directional antennas because they give you a distorted view compared to what a typical station sees. Still, it is nice to have the option because if you are using your sniffer to find a rogue AP then you can rig up a directional antenna and track in the direction where the signal is highest. The other advantage of the SR71-USB is that it has a higher transmit power and lower receive sensitivity. That can be especially nice for demodulating frames from greater distances when you're looking for interfering WiFi devices. (And if you're curious about the exact specs, here they are for the WUSB600N and the SR71-USB.)
Though the SR71-USB does cost more than the WUSB600N (I paid $125 + shipping for mine), I think the aforementioned advantages make it worth the extra cost. And that leads me to my next topic: why the heck doesn't WildPackets support the SR71-USB for OmniPeek? The SR71-USB uses the Atheros AR9280 chipset. WildPackets has a long and glorious history of support for adapters that use Atheros chipsets, so support for the SR71-USB would seem like a no-brainer. Yet, when I look at the WildPackets drivers list the most recent Atheros driver that I see support for is the AR5008.
I do expect that WildPackets will soon support the SR71-USB for use with OmniPeek. And when they do that adapter will become the clear choice for people interested in professional-grade WiFi sniffing. Until then, people like me who use both AirMagnet WiFi Analyzer and WildPackets OmniPeek are going to have to continue carrying around two adapters.
My last note for this post is that I realize that I have a backlog of topics to discuss on the Sniff WiFi blog and I want to get to them soon. I still have to sniff the Verizon MiFi 2200 and I still want to give a rundown of the actual sniffing experience using the SR71-USB with AirMagnet. Also, I want to do a piece on using OmniPeek to ferret out the reasons for connection problems when you're using WPA/WPA2 Enterprise. I hope to cover at least one of those things before the end of 2009, so check back next week.
11 months later and still no AR9280 support :(
ReplyDeleteYour blog is very useful.
ReplyDeleteWhat model of Omnipeek do you use with Linksys600 card?
Thanks!