Using AirMagnet to Analyze Voice Over WiFi

Mice in beer bottles, cold hands and supporting VoIP applications. These are a few of a wireless admin's least favorite things. And while this blog is the wrong place to look for solutions to two of those problems, here are some things to look for when evaluating software that lets you talk.

Voice over WiFi is a topic that yours truly has written about before, but never in any real detail on this blog. Part of the reason is that the previously linked whitepaper was something less than a performance for the ages, and part of the reason is that VoFi is still a ways away from being a pervasive technology.

Over the last few weeks the need to use VoFi software has arisen, and now is as good a time as any to describe how WiFi analysis software can be used to sniff out (pun not intended. Seriously. That word that is also in the name of this blog WAS TOTALLY ACCIDENTAL AND WITHOUT ANY INTENT AT SELF-PROMOTION AT ALL.) which VoIP application is best.

The two applications I sometimes use to make VoFi calls are Skype and Truphone. In the case of Truphone, "sometimes" means "often" and in the case of Skype, "sometimes" means "only when absolutely forced to by Skype loyalists who have yet to realize that the software stinks". Skype and Truphone both allow the user to make calls to the public phone network for a small fee and both run on a variety of mobile operating systems (including the only one the author really cares about, iOS). The big difference is that Truphone's calls usually sound great, and Skype's calls usually sound like you might expect this phone to sound. 

When deploying VoFi across an enterprise, applications like Skype and Truphone are less commonly used. The more likely scenario is that VoFi phones and/or SIP-based applications will be used. Still, the testing methodology is the same. It is best to get on a call, sniff the WiFi frames and see which application handles unlicensed frequencies the best.

I decided to switch things up for this post and use Fluke AirMagnet WiFi Analyzer. The same basic activities can be done with WildPackets OmniPeek, but this time I decided to go for AirMagnet's simpler navigation.

I began by using my iPhone 4 to make a Skype call on a Linksys 802.11g wireless router that is using TKIP encryption. Once in AirMagnet I navigated to the Infrastructure screen and selected Tx Total/% Total in the statistical analysis area that shows up here in the lower right hand corner of the screen:

I immediately found trouble. Look at that f'n Retry percentage. 34%!?! What the blue heck. Compare that with the same look at a Truphone call:

Same client station. Same wireless router. Same channel. One-sixth the Retrys. Just 6%, to be exact. After seeing this it ceased to be a mystery to me why Truphone's call quality has always been so much better on my iPhone.

But, why? What the heck is Truphone doing that Skype isn't? Let's let the eagle-eyed sniffers figure this one out.

First, here are two frames that were captured during the Skype call.

Skype from the wireless router (MAC address ending in 11:65):

Skype from the iPhone (MAC address ending in F5:C1):

Now, let's take a look at Truphone. Just like with Skype, the first screenshot will be of a frame sent by the wireless router and the second screenshot will be of a frame sent by the iPhone:

So, what's different here?

The first difference is that with Truphone, the wireless router is giving the Truphone call Video priority. If you look at the QoS Control field of the frames, you'll see that Best Effort is being used for Skype, while Video is being used for Truphone. The reason for the difference is a mystery to yours truly, but obviously Truphone is doing something with their end-to-end software that allows the wireless router that was used for this test to prioritize Truphone traffic ahead of ordinary traffic.

The bigger difference is in the traffic coming from the iPhone. The QoS Data frames looks the same, but check out what precedes the QoS Data frame when the iPhone transmits a Truphone frame. It's Request-to-Send/Clear-to-Send (RTS/CTS). The Truphone app is apparently lowering the iPhone's RTS Threshold for Truphone traffic only and using RTS/CTS to keep the channel clear. The RTS and CTS frames are pure overhead, but they are small (20 bytes and 14 bytes, respectively). And whatever overhead they add is compensated for in spades by the great effect those frames have in reducing the percentage of Retrys.

The same basic testing can be done with SIP applications (or any other media applications, for that matter). A quick look at the frames being sent and received by smartphones and other mobile devices can reveal a lot about which software is good and which software is Skype-like.