I Have Seen the Future (of WiFi Sniffing), and It Is OmniPeek (on a Mac)

Yours Truly has been worried about the future of WiFi sniffing.  Yours Truly worries about the people (they seem to prefer site surveyors) the software (AirMagnet has yet to support 802.11ac adapters) and the methods (WildPackets has been pushing AP-based capture).  To a person who believes that portable WiFi sniffing is essential for optimizing WiFi performance, it is all very disconcerting.  And yet, there is hope.  WiFi sniffing is ready to step into the 802.11ac/Internet of Everything era, and here is how it can be done.

 WildPackets OmniPeek has long been the author's favorite WiFi sniffer, but it only runs on Windows.  For years and years and years that was fine.  There were always a few Windows-compatible WiFi adapters that worked great with OmniPeek.  Now, however, WildPackets has gone in a different direction.  They are promoting WiFi sniffing via an AP (which often results in a worthless capture) and saying that they don't expect USB-based capture to be viable for 802.11ac.

So, what to do?  OmniPeek only runs on Windows, but they're not planning to support capture via Windows-compatible USB adapters.

The answer is to switch to a Mac and use virtualization software.  Here is what I did:

1) Buy a Mac

I prefer the MacBook Air because it is cheap, light and cool.  (Literally cool.  Meaning temperature.  The darned MacBook Pro gets too hot to place comfortably on your lap.)

2) Buy Parallels

Parallels is virtualization software and it runs seamlessly on a Mac.  Check out OmniPeek:


You can see the little Apple logo in the upper left, showing that I'm running Mac OS X as I run OmniPeek.

3) Capture in Wireless Diagnostics

I even made a video to show you how!  

In case the video is unclear, you hold down the alt/option before clicking the WiFi icon on the top menu bar.  Then you select "Wireless Diagnostics", go to the "Window" menu, choose "Utilities", click on "Frame Capture" and select your capture channel & bandwidth before clicking "Start".  YOu click "Stop" when you're done capturing.

4) Open the capture file into OmniPeek


In case the picture above is unclear, you go to the Desktop, right-click on your *.wcap capture file, select "Open With" and select OmniPeek.

5) That's it!

The limitation of this method is that you're unable to see live frames as they are captured.  Boo hoo.  (Actually, it's more than boo hoo.  For certain tasks (like analyzing Probing behavior), not having access to a live capture is a real problem.  But for most tasks, analyzing a capture file after the actual WiFi sniffing is done is just fine.)

On a MacBook Air, the capture I open in OmniPeek is a two-stream, 802.11ac capture.  On a MacBook Pro, it would be a three-stream 802.11ac capture.  That means capturing on an Air will result in me missing data sent and received by a Pro.  Most 802.11a/b/g/n/ac devices will have all of their WiFi traffic captured just fine by an Air, however.

I am still hoping that someone creates a three-stream 802.11ac USB adapter that I can use for OmniPeek (or Fluke AirMagnet WiFi Analyzer, for that matter) capture, but in the meantime these steps will allow you to do useful, portable captures now and in the future.

***

If you like my blog, you can support it by shopping through my Amazon link or donating Bitcoin to 1N8m1o9phSkFXpa9VUrMVHx4LJWfratseU

Thank you.

Comments

  1. DevinatorApril 23, 2014 at 10:16 PM

    Excellent blog Ben. Nicely done.

    ReplyDelete
  2. PMApril 24, 2014 at 1:17 AM

    How about instead of a Mac you use an AP to capture data. The steps that follow are the same and 3 stream APs are getting cheaper every day compared to a Mac.

    ReplyDelete
    Replies
    1. wifistrongApril 29, 2014 at 12:04 PM

      You would still need OmniPeek to analyze the data. You can also use multiple USB adapters to capture on multiple channels for roaming analysis.

      Delete
  3. Ben MillerApril 29, 2014 at 5:26 PM

    Devin: Thank you, my man.

    Primož: APs aren't portable enough.

    ReplyDelete
    Replies
    1. Tom Carpenter - CWNP, CTOFebruary 20, 2015 at 8:02 AM

      I know, I'm late to the game, but I'm sure many view this post daily :-). APs are definitely not portable enough, but you can get a Cisco WAP371 and a power adapter, then you can take it to a user's work area, plug in and connect it to Ethernet and then remote cap with wireshark or OmniPeek (in a VM) on your MacBook. This is better than settling for 2x2 ac capture if you lack a MacBook Pro or a COMPUTER WITH AN EXPRESSCARD! Of course no one knows what I'm talking about there :-)

      Delete
  4. AndresMay 12, 2014 at 6:53 AM

    Hello Ben,

    Contratulations for your article.

    You can capture WiFi packets with Wireshark under windows by installing Acrylic WiFi https://www.acrylicwifi.com/en/blog/how-to-capture-wifi-traffic-using-wireshark-on-windows/

    Acrylic WiFi is free, and enables monitor mode capture under windows with most wifi cards

    ReplyDelete
    Replies
    1. Ben MillerMay 29, 2014 at 11:23 AM

      Acrylic doesn't do monitor mode that I can tell.

      Delete
  5. UnknownJuly 14, 2014 at 8:05 AM

    You can also use Wireshark in OS X to capture in monitor mode live. Wireshark has the ability to enable the airport card into Monitor Mode through the interface options. You can also use the 'airport' terminal command to change the channel or even dissociate from the network.

    The 'airport' command is hidden away in a folder: '/System/Library//PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport' but a simple symbolic link to /usr/bin (or other folder) will give you quick and easy access in the Terminal.

    sudo airport -h to get a list of all commands.

    sudo airport -z to dissociate
    sudo airport -I to get info about the current connection/configuration of the airport card
    sudo airport --channel=x to set to channel x (may have to run this a couple times to get the card to switch -- works best when not connected to a network [like after issue airport -z])

    sudo airport enX sniff will start a monitor mode capture on interface X (probably en0 on an MBA)


    Hope this helps!

    ReplyDelete
  6. spacepacketAugust 5, 2014 at 12:45 PM

    Ben, We have released a new wireless version of the TCPDump Remote Adapter that can capture 802.11ac in real-time from a MacBook or MacAir. http://bit.ly/1zRaGBT

    ReplyDelete

Post a Comment

Popular posts from this blog

Five Facts About 6 GHz Wi-Fi

Image
Two pieces of important news hit the wire recently: the 6 GHz band was approved for Wi-Fi, and alcohol sales have skyrocketed .  Combine the two, and what do we get? A five-pack of Coors Light Cold Hard Facts about Wi-Fi in the 6 GHz frequency band. Editor's note: This is a relatively long post, but 6 GHz Wi-Fi is an undoubtably robust topic. If you have questions after reading this blog, comment below or contact Ben via email or Twitter using the information below, and Sniff Wi-Fi will address those answers in a future post. We may be knee-deep in a global pandemic, but that doesn't mean your humble blogger can't brew up a post on the topic of 6 GHz Wi-Fi. Wi-Fi professionals will soon have unlicensed frequency available in the 6 GHz band. Here, then, are five facts to know about Wi-Fi in the soon-to-be-available 6 GHz frequency band. Fact #1: The 6 GHz band adds 1,200 MHz of spectrum for Wi-Fi The Federal Communications Commission (FCC) is the federal
Read more

Chips, Glorious Wi-Fi 6E Chips!

Qualcomm, owners of the Atheros line of Wi-Fi radios, recently announced the availability of Wi-Fi 6E chips. Game onnnnnnn! 6 GHz Wi-Fi is here. Sort of... Qualcomm is selling Wi-Fi 6E (802.11ax w/ 6 GHz support) chips, but we don't yet know when enterprise-grade APs and mobile devices will begin supporting 6 GHz Wi-Fi. Chip-to-product timelines can vary. Wi-Fi 5 (802.11ac) saw enterprise WLAN vendors sell products only a few months after chip announcements. Wi-Fi 6 (802.11ax) saw the big vendors wait a year or more before introducing new AP models. A ton of concerns factor into a vendor's decision on when to develop, manufacture and market new AP technology. Vendors with small market share may be extra eager. Aerohive tried to boost their enterprise Wi-Fi profile by being a leader in Wi-Fi 6. On the other hand, some vendors' enthusiasm for new Wi-Fi hardware may be dulled by competing organizational initiatives. Aruba/HPE, for example, was veering f
Read more

Go To Sleep, Go To Sleep, Go To Sleep Little iPhone

Image
In some circles, Apple Wi-Fi devices are knows to have problems with lost connections.  iPhones and iPads will unexpectedly miss incoming calls, have delays in receiving push notifications and even be forced to reauthenticate. There is a solution to Apple devices' connection problems, and as with most "device problems", the fix resides on the infrastructure.  The DTIM setting needs to be increased.  ( Apple recommends a setting of 3 or higher .)  Here's why: Some Apple Wi-Fi connection problems stem from Apple iOS devices' use of 802.11 power management.  To understand what Apple devices are doing with power management, one must first understand how 802.11 power management works. Let's start with unicast data.  The 802.11 standard allows devices' Wi-Fi radios to enter the Doze state in order to conserve battery life.  Wi-Fi radios in the Doze state are unable to receive data from the AP, so APs buffer all unicast data that has a destination MAC addr
Read more