We Rally 'Round The Sniffer (With A Pocket Full Of Cards)

Ahh, the good ol' days.  The days when USC was beating UCLA by 50 points, AirTran was flying nonstops from LAX to Milwaukee and WiFi sniffing folks only had to carry one USB card for 802.11 protocol analysis.  Those days are gone, my friends.  It's time to update which cards we need for which applications.

 December of 2011 was a time yours truly looks back on with fond memories for the reasons cited above.  In the wireless world, the good news was that WildPackets OmniPeek had begun supporting monitor mode capture from Atheros-based 802.11a/b/g/n chipsets, thus allowing one USB adapter to be used for any good WiFi sniffing app.

Things change, and when WLAN infrastructure vendors began selling APs that support three-stream spatial multiplexing (thus rendering high rate data frames un-sniffable to the D-Link DWA-160 802.11a/b/g/n USB adapter), the handwriting was on the wall.  The halcyon days of only needing one USB adapter for wireless protocol analysis were numbered.  For a while most client/station devices continued to use one-stream or two-stream spatial multiplexing, thus keeping my old USB friend relevant.

Today, too many devices use three-stream spatial multiplexing for it to be ignored.  If you try to run a protocol analyzer using an adapter that only supports up to two streams, you may end up with a worthless capture.

We can capture three-stream data if we have a three-stream adapter that is compatible with our Wi-Fi sniffing software, but there's a problem.  No single USB adapter works will every application.  If you want to be ready to use any protocol analyzer, you'll have to carry around a pocket full of capture devices.

It is doubtful that you come to this-a-here blog [DiCaprio-in-Django-Unchained voice] to see me whine about changin' tech-nol-gy (see, with a ludicrous Southern Gentleman accent, I can both add syllables and subtract).  So here, then are the current top options for getting a three-stream wireless data capture into a quality Wi-Fi sniffer:

  • WildPackets OmniPeek: Still my favorite Wi-Fi sniffer, and now it has a simple option for capturing 450 Mbps data.  The OmniWiFi adapter is a dual-band 802.11a/b/g/n USB adapter that supports three-stream capture.  
  • Fluke AirMagnet WiFi Analyzer: AirMagnet is still great software, but the capture options stink.  You're best bet is a laptop with an Intel 6300 internal Wi-Fi interface.  The problem is that rules out virtual machines (since USB adapters are available in virtual machines, but internal adapters are not) and Apple laptops (which use a Broadcom-based Wi-Fi interface).
  • Wireshark for Mac OS X: You can capture using the internal three-stream interface on a MacBook Pro (not MacBook Air) using Wi-Fi Diagnostics and open the captured .pcap file in Wireshark.
And this is even leaving out Wireshark for Linux, which works with the old DWA-160.  I'm unsure if there is a three-stream USB adapter that has monitor mode drivers for Linux Wireshark, but if anyone knows of one leave a comment or email me.

The hard truth is that this re-scattering of capture capabilities is annoying to a person like me, but may not matter as much to a WLAN administrator.  If you're just going to use one WiFi sniffer, then you can just choose the appropriate card option and go with it.


Comments

Post a Comment

Popular posts from this blog

Chips, Glorious Wi-Fi 6E Chips!

Qualcomm, owners of the Atheros line of Wi-Fi radios, recently announced the availability of Wi-Fi 6E chips. Game onnnnnnn! 6 GHz Wi-Fi is here. Sort of... Qualcomm is selling Wi-Fi 6E (802.11ax w/ 6 GHz support) chips, but we don't yet know when enterprise-grade APs and mobile devices will begin supporting 6 GHz Wi-Fi. Chip-to-product timelines can vary. Wi-Fi 5 (802.11ac) saw enterprise WLAN vendors sell products only a few months after chip announcements. Wi-Fi 6 (802.11ax) saw the big vendors wait a year or more before introducing new AP models. A ton of concerns factor into a vendor's decision on when to develop, manufacture and market new AP technology. Vendors with small market share may be extra eager. Aerohive tried to boost their enterprise Wi-Fi profile by being a leader in Wi-Fi 6. On the other hand, some vendors' enthusiasm for new Wi-Fi hardware may be dulled by competing organizational initiatives. Aruba/HPE, for example, was veering f...
Read more

Five Facts About 6 GHz Wi-Fi

Image
Two pieces of important news hit the wire recently: the 6 GHz band was approved for Wi-Fi, and alcohol sales have skyrocketed .  Combine the two, and what do we get? A five-pack of Coors Light Cold Hard Facts about Wi-Fi in the 6 GHz frequency band. Editor's note: This is a relatively long post, but 6 GHz Wi-Fi is an undoubtably robust topic. If you have questions after reading this blog, comment below or contact Ben via email or Twitter using the information below, and Sniff Wi-Fi will address those answers in a future post. We may be knee-deep in a global pandemic, but that doesn't mean your humble blogger can't brew up a post on the topic of 6 GHz Wi-Fi. Wi-Fi professionals will soon have unlicensed frequency available in the 6 GHz band. Here, then, are five facts to know about Wi-Fi in the soon-to-be-available 6 GHz frequency band. Fact #1: The 6 GHz band adds 1,200 MHz of spectrum for Wi-Fi The Federal Communications Commission (FCC) is the federal ...
Read more

Go To Sleep, Go To Sleep, Go To Sleep Little iPhone

Image
In some circles, Apple Wi-Fi devices are knows to have problems with lost connections.  iPhones and iPads will unexpectedly miss incoming calls, have delays in receiving push notifications and even be forced to reauthenticate. There is a solution to Apple devices' connection problems, and as with most "device problems", the fix resides on the infrastructure.  The DTIM setting needs to be increased.  ( Apple recommends a setting of 3 or higher .)  Here's why: Some Apple Wi-Fi connection problems stem from Apple iOS devices' use of 802.11 power management.  To understand what Apple devices are doing with power management, one must first understand how 802.11 power management works. Let's start with unicast data.  The 802.11 standard allows devices' Wi-Fi radios to enter the Doze state in order to conserve battery life.  Wi-Fi radios in the Doze state are unable to receive data from the AP, so APs buffer all unicast data that has a destination MAC ...
Read more