Can Single Stream Sniffing Work?

A bunch of WiFi vendors made presentations at the Wireless Field Day events a couple of weeks ago, and the one that piqued my interest the most (at least in a positive way) was WildPackets'.  The WildPackets OmniPeek software can now sniff 802.11ac traffic, with a catch.  The catch?  It only sniffs single streams 802.11ac traffic.  Is that a useful thing?

First things, first: In order to sniff 802.11ac traffic, you need a AE6000 (Linksys Wireless Mini USB Adapter AC 580 Dual Band) adapter.  (And if you decide to buy one and want to support this blog, you can use that link to Amazon.)

The AE6000 adapter is a single stream 802.11ac adapter with a Ralink chipset.  WildPackets is developing a driver for the Ralink chipset and demonstrated the AE6000 in action.  The expectation is that it will be a month or two before the OmniPeek drivers for the AE6000 actually get released, but I bought one so that I'm ready.

Being able to sniff 802.11ac traffic may be great, but the even greater question is, "how useful is single stream sniffing?"

After all, it was less than six months ago that yours truly was writing that three stream capture is necessary for the modern enterprise.  Without three stream capture, the data going to and from a lot of laptops and media centers is going to be missed.  If you work in an area that needs to support those types of devices, that makes three streams a requirement for in-depth troubleshooting.

There are some use cases for single stream capture.  Smartphones, tablets, bar code scanners, point of sale terminals and a number of other smaller devices all use single stream WiFi, and are expected to for the foreseeable future.  All data going to and from those devices can be captured with a well-placed AE6000.

In the future we may see even more devices embrace single stream WiFi.  Remember, single stream WiFi saves battery life.  We all know how frustrated users get with laptops that can't hold a charge.  Just from my personal experience, I can tell you that I would gladly trade my MacBook Air's two stream WiFi interface for my iPad's single stream interface.  My iPad has slower networking than my MacBook Air, but not slow enough that it bugs me.  I'll gladly take a little bit of delay in my web surfing, emailing and perusing of Twitter in order to extend my laptop's battery life.  I have to imagine that there are a lot more people out there like me, and so I expect that laptop makers will start to embrace single stream WiFi radios at some point in an effort to serve us battery life fiends.

For today, though, just make sure you know what you're trying to sniff.  If you have a bunch of tablets and smartphones that need attention, then the AE6000 works.  If the environment includes some multi-stream devices, then stick to sniffing from an adapter that supports multiple streams.

Comments

  1. Embedded *April 23, 2014 at 5:57 AM

    I have install AE6000 drivers and device got detected.
    When i open omnipeek(7.8) in the adapter it displaying "wildPackets API No"
    Pls help me how to resolve this.

    ReplyDelete
  2. neuromonkeyApril 16, 2016 at 4:26 PM

    https://forums.savvius.com/viewtopic.php?t=1841

    ReplyDelete

Post a Comment

Popular posts from this blog

Chips, Glorious Wi-Fi 6E Chips!

Qualcomm, owners of the Atheros line of Wi-Fi radios, recently announced the availability of Wi-Fi 6E chips. Game onnnnnnn! 6 GHz Wi-Fi is here. Sort of... Qualcomm is selling Wi-Fi 6E (802.11ax w/ 6 GHz support) chips, but we don't yet know when enterprise-grade APs and mobile devices will begin supporting 6 GHz Wi-Fi. Chip-to-product timelines can vary. Wi-Fi 5 (802.11ac) saw enterprise WLAN vendors sell products only a few months after chip announcements. Wi-Fi 6 (802.11ax) saw the big vendors wait a year or more before introducing new AP models. A ton of concerns factor into a vendor's decision on when to develop, manufacture and market new AP technology. Vendors with small market share may be extra eager. Aerohive tried to boost their enterprise Wi-Fi profile by being a leader in Wi-Fi 6. On the other hand, some vendors' enthusiasm for new Wi-Fi hardware may be dulled by competing organizational initiatives. Aruba/HPE, for example, was veering f...
Read more

Five Facts About 6 GHz Wi-Fi

Image
Two pieces of important news hit the wire recently: the 6 GHz band was approved for Wi-Fi, and alcohol sales have skyrocketed .  Combine the two, and what do we get? A five-pack of Coors Light Cold Hard Facts about Wi-Fi in the 6 GHz frequency band. Editor's note: This is a relatively long post, but 6 GHz Wi-Fi is an undoubtably robust topic. If you have questions after reading this blog, comment below or contact Ben via email or Twitter using the information below, and Sniff Wi-Fi will address those answers in a future post. We may be knee-deep in a global pandemic, but that doesn't mean your humble blogger can't brew up a post on the topic of 6 GHz Wi-Fi. Wi-Fi professionals will soon have unlicensed frequency available in the 6 GHz band. Here, then, are five facts to know about Wi-Fi in the soon-to-be-available 6 GHz frequency band. Fact #1: The 6 GHz band adds 1,200 MHz of spectrum for Wi-Fi The Federal Communications Commission (FCC) is the federal ...
Read more

Go To Sleep, Go To Sleep, Go To Sleep Little iPhone

Image
In some circles, Apple Wi-Fi devices are knows to have problems with lost connections.  iPhones and iPads will unexpectedly miss incoming calls, have delays in receiving push notifications and even be forced to reauthenticate. There is a solution to Apple devices' connection problems, and as with most "device problems", the fix resides on the infrastructure.  The DTIM setting needs to be increased.  ( Apple recommends a setting of 3 or higher .)  Here's why: Some Apple Wi-Fi connection problems stem from Apple iOS devices' use of 802.11 power management.  To understand what Apple devices are doing with power management, one must first understand how 802.11 power management works. Let's start with unicast data.  The 802.11 standard allows devices' Wi-Fi radios to enter the Doze state in order to conserve battery life.  Wi-Fi radios in the Doze state are unable to receive data from the AP, so APs buffer all unicast data that has a destination MAC ...
Read more