A Choice of Filters

People who do WLAN analysis agree that filtering is a part of sniffing WiFi frames/packets.  More information can be extracted from captures when the focus is on one AP or station or protocol (or a combination of same).  Where people disagree is on which type of filtering is best: capture filters or display filters?  Yours truly is a capture filter man, and some iPhone analysis was a reminder why.

Filtering 802.11 captures is covered pretty well in the CWAP Study Guide (of which I am a co-author).  A capture filter extracts frames before they are captured.  The only frames captured are the ones that match the filter.  A display filter extracts frames after they are captured.  Every frame is captured.  Then the filter is applied so that only frames matching the filter are shown in the protocol analyzer.  To use the example of a filter on my iPhone, if a capture filter were used then all of the frames from all of the other stations on my iPhone's channel would be lost.  Using a display filter, on the other hand, would mean that everything is captured.  Nothing is lost.  The filter for my iPhone would be applied after the capture has been done, thus allowing frames from other stations to be analyzed later.

The CWAP Study Guide takes a neutral position on WiFi capture filters, but the CWAP course written by Marcus Burton is friendlier to display filters.  The rationale make sense on the surface: with a display filter nothing is lost.  If an iPhone is being analyzed and the iPhone's frames appear to betray a congestion problem, the display filter can be removed and frames from other stations or APs can be examined.  If a capture filter is used, then that moment of congestion may have been lost.  Those uncaptured frames can never be examined.

There is a down side to using display filters, especially in a congested area: the lack of real-time analysis.  It can be tremendously valuable to be able to watching frames as they are being captured.  If you know what WiFi should look like, then you may be able to identify cases where the WiFi is having problems.  (That's how I fingered the APs as the culprit when investigating that iPhone VoIP problem that I blogged about a while back.  I watched the frames show up in OmniPeek in real time and saw a stream of Retrys.)  

In general, the best way to filter will depend on your level of expertise.  If you are relative new to sniffing WiFi, then it's probably best to use display filters.  You probably won't know what to look for in real time, so it will be best to keep all captured frames.  Once you become an expert, then switching to capture filters is usually better.  The ability to correlate real world, real time behavior (What app is running now?  Is the tablet moving now?  Is the user actively using her device now?) with that scrolling trace of captured frames/packets is often valuable in identifying what is really going on.

If you like my blog, you can support it by shopping through my Amazon link.  Same Amazon store and prices, but I get a kickback.  Thank you.

Comments

  1. Kiran AshokanJanuary 30, 2014 at 5:04 PM

    Have you by any chance figured out how to use display filter during live captures in Omnipeek?

    ReplyDelete
  2. Ben MillerJanuary 31, 2014 at 12:33 PM

    After you stop capturing, go to the Packets screen (use the menu on the left hand side). There is a funnel icon above that allows you to choose any of your filters.

    ReplyDelete
    Replies
    1. Kiran AshokanJanuary 31, 2014 at 2:49 PM

      Thanks Ben!

      But I wanted to use display filter during live captures (like what you could do with Wireshark); I guess that is not supported.

      Delete
    2. UnknownFebruary 1, 2014 at 9:09 AM

      Sadly you can't. From the manual: "Display filters are available from active capture windows only after the capture is stopped. They are always available from saved capture files"

      Delete
  3. UnknownFebruary 1, 2014 at 9:15 AM

    I think this has more to do with the situation than the level of expertise. If a problem can be reliably reproduced, then capture filters are fine; however, if it's intermittent (but persistent), then I always advocate grabbing everything to try and understand the complete situation.

    The tools make a difference too - Wireshark allows applying display filters on a live capture, while OmniPeek doesn't, etc. If I'm trying to debug a problem in real-time I tend to use Wireshark as it allows much more 'down and dirty' analysis, but OmniPeek is far better for deep or trend analysis.

    ReplyDelete

Post a Comment

Popular posts from this blog

Chips, Glorious Wi-Fi 6E Chips!

Qualcomm, owners of the Atheros line of Wi-Fi radios, recently announced the availability of Wi-Fi 6E chips. Game onnnnnnn! 6 GHz Wi-Fi is here. Sort of... Qualcomm is selling Wi-Fi 6E (802.11ax w/ 6 GHz support) chips, but we don't yet know when enterprise-grade APs and mobile devices will begin supporting 6 GHz Wi-Fi. Chip-to-product timelines can vary. Wi-Fi 5 (802.11ac) saw enterprise WLAN vendors sell products only a few months after chip announcements. Wi-Fi 6 (802.11ax) saw the big vendors wait a year or more before introducing new AP models. A ton of concerns factor into a vendor's decision on when to develop, manufacture and market new AP technology. Vendors with small market share may be extra eager. Aerohive tried to boost their enterprise Wi-Fi profile by being a leader in Wi-Fi 6. On the other hand, some vendors' enthusiasm for new Wi-Fi hardware may be dulled by competing organizational initiatives. Aruba/HPE, for example, was veering f...
Read more

Five Facts About 6 GHz Wi-Fi

Image
Two pieces of important news hit the wire recently: the 6 GHz band was approved for Wi-Fi, and alcohol sales have skyrocketed .  Combine the two, and what do we get? A five-pack of Coors Light Cold Hard Facts about Wi-Fi in the 6 GHz frequency band. Editor's note: This is a relatively long post, but 6 GHz Wi-Fi is an undoubtably robust topic. If you have questions after reading this blog, comment below or contact Ben via email or Twitter using the information below, and Sniff Wi-Fi will address those answers in a future post. We may be knee-deep in a global pandemic, but that doesn't mean your humble blogger can't brew up a post on the topic of 6 GHz Wi-Fi. Wi-Fi professionals will soon have unlicensed frequency available in the 6 GHz band. Here, then, are five facts to know about Wi-Fi in the soon-to-be-available 6 GHz frequency band. Fact #1: The 6 GHz band adds 1,200 MHz of spectrum for Wi-Fi The Federal Communications Commission (FCC) is the federal ...
Read more

Go To Sleep, Go To Sleep, Go To Sleep Little iPhone

Image
In some circles, Apple Wi-Fi devices are knows to have problems with lost connections.  iPhones and iPads will unexpectedly miss incoming calls, have delays in receiving push notifications and even be forced to reauthenticate. There is a solution to Apple devices' connection problems, and as with most "device problems", the fix resides on the infrastructure.  The DTIM setting needs to be increased.  ( Apple recommends a setting of 3 or higher .)  Here's why: Some Apple Wi-Fi connection problems stem from Apple iOS devices' use of 802.11 power management.  To understand what Apple devices are doing with power management, one must first understand how 802.11 power management works. Let's start with unicast data.  The 802.11 standard allows devices' Wi-Fi radios to enter the Doze state in order to conserve battery life.  Wi-Fi radios in the Doze state are unable to receive data from the AP, so APs buffer all unicast data that has a destination MAC ...
Read more