Can Single Stream Sniffing Work?
A bunch of WiFi vendors made presentations at the Wireless Field Day events a couple of weeks ago, and the one that piqued my interest the most (at least in a positive way) was WildPackets'. The WildPackets OmniPeek software can now sniff 802.11ac traffic, with a catch. The catch? It only sniffs single streams 802.11ac traffic. Is that a useful thing?
First things, first: In order to sniff 802.11ac traffic, you need a AE6000 (Linksys Wireless Mini USB Adapter AC 580 Dual Band)
adapter. (And if you decide to buy one and want to support this blog, you can use that link to Amazon.)
The AE6000 adapter is a single stream 802.11ac adapter with a Ralink chipset. WildPackets is developing a driver for the Ralink chipset and demonstrated the AE6000 in action. The expectation is that it will be a month or two before the OmniPeek drivers for the AE6000 actually get released, but I bought one so that I'm ready.
Being able to sniff 802.11ac traffic may be great, but the even greater question is, "how useful is single stream sniffing?"
After all, it was less than six months ago that yours truly was writing that three stream capture is necessary for the modern enterprise. Without three stream capture, the data going to and from a lot of laptops and media centers is going to be missed. If you work in an area that needs to support those types of devices, that makes three streams a requirement for in-depth troubleshooting.
There are some use cases for single stream capture. Smartphones, tablets, bar code scanners, point of sale terminals and a number of other smaller devices all use single stream WiFi, and are expected to for the foreseeable future. All data going to and from those devices can be captured with a well-placed AE6000.
In the future we may see even more devices embrace single stream WiFi. Remember, single stream WiFi saves battery life. We all know how frustrated users get with laptops that can't hold a charge. Just from my personal experience, I can tell you that I would gladly trade my MacBook Air's two stream WiFi interface for my iPad's single stream interface. My iPad has slower networking than my MacBook Air, but not slow enough that it bugs me. I'll gladly take a little bit of delay in my web surfing, emailing and perusing of Twitter in order to extend my laptop's battery life. I have to imagine that there are a lot more people out there like me, and so I expect that laptop makers will start to embrace single stream WiFi radios at some point in an effort to serve us battery life fiends.
For today, though, just make sure you know what you're trying to sniff. If you have a bunch of tablets and smartphones that need attention, then the AE6000 works. If the environment includes some multi-stream devices, then stick to sniffing from an adapter that supports multiple streams.
adapter. (And if you decide to buy one and want to support this blog, you can use that link to Amazon.) The AE6000 adapter is a single stream 802.11ac adapter with a Ralink chipset. WildPackets is developing a driver for the Ralink chipset and demonstrated the AE6000 in action. The expectation is that it will be a month or two before the OmniPeek drivers for the AE6000 actually get released, but I bought one so that I'm ready.
Being able to sniff 802.11ac traffic may be great, but the even greater question is, "how useful is single stream sniffing?"
After all, it was less than six months ago that yours truly was writing that three stream capture is necessary for the modern enterprise. Without three stream capture, the data going to and from a lot of laptops and media centers is going to be missed. If you work in an area that needs to support those types of devices, that makes three streams a requirement for in-depth troubleshooting.
There are some use cases for single stream capture. Smartphones, tablets, bar code scanners, point of sale terminals and a number of other smaller devices all use single stream WiFi, and are expected to for the foreseeable future. All data going to and from those devices can be captured with a well-placed AE6000.
In the future we may see even more devices embrace single stream WiFi. Remember, single stream WiFi saves battery life. We all know how frustrated users get with laptops that can't hold a charge. Just from my personal experience, I can tell you that I would gladly trade my MacBook Air's two stream WiFi interface for my iPad's single stream interface. My iPad has slower networking than my MacBook Air, but not slow enough that it bugs me. I'll gladly take a little bit of delay in my web surfing, emailing and perusing of Twitter in order to extend my laptop's battery life. I have to imagine that there are a lot more people out there like me, and so I expect that laptop makers will start to embrace single stream WiFi radios at some point in an effort to serve us battery life fiends.
For today, though, just make sure you know what you're trying to sniff. If you have a bunch of tablets and smartphones that need attention, then the AE6000 works. If the environment includes some multi-stream devices, then stick to sniffing from an adapter that supports multiple streams.
I have install AE6000 drivers and device got detected.
ReplyDeleteWhen i open omnipeek(7.8) in the adapter it displaying "wildPackets API No"
Pls help me how to resolve this.
https://forums.savvius.com/viewtopic.php?t=1841
ReplyDelete