Worthless Capture, Part II (Or, "Why I Need To Buy A MacBook Pro")
A year ago yours truly wrote about the importance of device location when capturing Wi-Fi frames in a post titled, "Worthless Capture". Well, recently another Wi-Fi sniffing bugaboo has become more prevalent: devices that lack the physical capability to capture a data frames.
This whole problem really stems from 802.11n. As many people (including the author) found out when the iPad was released in 2010, not all 802.11n devices have the same capabilities. That is an annoyance to consumers, but it's downright dangerous to Wi-Fi professionals. Most Wi-Fi networks require sniffing at some point (for surveying, for event preparation, for troubleshooting, etc.), but most Wi-Fi sniffing devices are incapable of sniffing high rate data frames.
One more time: Most Wi-Fi sniffing devices are incapable of sniffing high rate data frames.
The Linksys WUSB600N, which yours truly uses to sniff with WildPackets OmniPeek? Only 2 radio chains (a radio chain is a transceiver/antenna pair), so no 3 stream spatial multiplexing (which is required for rates above 300 Mbps) .
The D-Link DWA-160, which is one of the few adapters that works with OmniPeek, Fluke AirMagnet WiFi Analyzer and the Linux version of Wireshark? Only 2 radio chains. (Same for the Ubiquiti SR71-USB, which has the same chipset as the DWA-160 and supports external antennas.)
AirPcap NX, which is the only way to get a monitor mode capture with the Windows version of Wireshark? Also only 2 radio chains.
Basically, if you want to capture high rate data frames with an external Wi-Fi adapter, you're [excrement] out of luck. At least most of the time.
What can you use to sniff Wi-Fi frames that use 3 stream spatial multiplexing?
Why, a MacBook Pro (not Air). The MacBook Pro (like all Mac OS X 10.7 or 10.8 devices) has the Wi-Fi Diagnostics utility that supports monitor mode capture through the built-in Wi-Fi interface. And the MacBook Pro's built-in Wi-Fi interface has 3 radio chains. So the bottom line is that I need to get me a MacBook Pro, otherwise I'll continue to miss valuable frames when 3 stream data frames go through the air.
It should be noted that a limited number of devices support 450 Mbps Wi-Fi (which is what 3 stream spatial multiplexing maxes out at), so you may not need a 3 stream capture device. iPhones (and other smartphones), iPads (and other tablets), MacBook Airs, netbooks, eReaders, bar code scanners and point-of-sale terminals all have built-in Wi-Fi adapters with only 1 or 2 radio chains. The next Sniff WiFi blog post will cover how you can check to see if you actually need to capture using a 3 radio chain adapter.
This whole problem really stems from 802.11n. As many people (including the author) found out when the iPad was released in 2010, not all 802.11n devices have the same capabilities. That is an annoyance to consumers, but it's downright dangerous to Wi-Fi professionals. Most Wi-Fi networks require sniffing at some point (for surveying, for event preparation, for troubleshooting, etc.), but most Wi-Fi sniffing devices are incapable of sniffing high rate data frames.
One more time: Most Wi-Fi sniffing devices are incapable of sniffing high rate data frames.
The Linksys WUSB600N, which yours truly uses to sniff with WildPackets OmniPeek? Only 2 radio chains (a radio chain is a transceiver/antenna pair), so no 3 stream spatial multiplexing (which is required for rates above 300 Mbps) .
The D-Link DWA-160, which is one of the few adapters that works with OmniPeek, Fluke AirMagnet WiFi Analyzer and the Linux version of Wireshark? Only 2 radio chains. (Same for the Ubiquiti SR71-USB, which has the same chipset as the DWA-160 and supports external antennas.)
AirPcap NX, which is the only way to get a monitor mode capture with the Windows version of Wireshark? Also only 2 radio chains.
Basically, if you want to capture high rate data frames with an external Wi-Fi adapter, you're [excrement] out of luck. At least most of the time.
What can you use to sniff Wi-Fi frames that use 3 stream spatial multiplexing?
Why, a MacBook Pro (not Air). The MacBook Pro (like all Mac OS X 10.7 or 10.8 devices) has the Wi-Fi Diagnostics utility that supports monitor mode capture through the built-in Wi-Fi interface. And the MacBook Pro's built-in Wi-Fi interface has 3 radio chains. So the bottom line is that I need to get me a MacBook Pro, otherwise I'll continue to miss valuable frames when 3 stream data frames go through the air.
It should be noted that a limited number of devices support 450 Mbps Wi-Fi (which is what 3 stream spatial multiplexing maxes out at), so you may not need a 3 stream capture device. iPhones (and other smartphones), iPads (and other tablets), MacBook Airs, netbooks, eReaders, bar code scanners and point-of-sale terminals all have built-in Wi-Fi adapters with only 1 or 2 radio chains. The next Sniff WiFi blog post will cover how you can check to see if you actually need to capture using a 3 radio chain adapter.
Ben,
ReplyDeleteYou might want to change your title as you don't want the MacBook Air. Otherwise a very informative article.
Good catch!
Delete