Sniff Wi-Fi

Wi-Fi is a technology used around the world and we, as Americans, respect all cultures and creeds.  That said, occasionally we like to celebrate ourselves (NSFW, as if the title didn't make it obvious): Unfortunately, America has been behind the times in Wi-Fi.  No longer!  We now have motherf*#king 2.4 GHz channels 12 and 13. This blog has a rigid rule to avoid politics, so I'll phrase this as apolitically as I possibly can: from January 20, 2009 to January 19, 2016, America's wireless authority -- the Federal Communications Commission (FCC) -- repeatedly authored rules that damaged Wi-Fi.  In 2010 the FCC banned Wi-Fi on channels 120 through 128, in 2014 the FCC messed up channels 52 through 144 by requiring additional dynamic frequency selection (DFS) scanning and in 2016 the FCC declined a proposal by satellite phone provider Globalstar to allow 2.4 GHz channels 12 and 13 to be used for "terrestrial, low power services" (TLPS), which just so happen t

Chatty smartphones have been an issue for years.  Whether you're concerned with security or performance  (or both), the amount of Probing being done by unconnected iPhones, Galaxies and the like has been worrisome.   Today, things have changed.  Smartphones don't Probe as much.  This is probably for the better, but there could be a catch. I'm an Apple guy.  Even when I was using PCs in college (things were different back in the 90's , I tell ya), it was always because they were free.  Once I finally had to buy a computer, I went straight to the very first iBook in 2001.  I own an iPod, iPad, iPhone and MacBook Air.  My next computing purchase will probably be an iMac (to better record those promised-but-not-yet-delivered online training videos on WiFi that I touted six months ago).  So, I like the company.  And I like bashing its competitors sometimes.  (Not my most magnanimous trait, but nobody's perfect.) I liked pointing out that Google's Android ope

About a year and a half ago, yours truly wrote about WiFi transmit power levels in iPhones .  Things have changed since then.  And possibly the biggest change (to iPhones, at least) is how aggressive iPhones are in modifying transmit power levels.   In the "Mighty iPhone Power Ranges" blog post, I wrote about the value of setting AP transmit power levels to approximately the same level as client/station device power levels.  Over the past year or so, more and more client/station devices have started using adaptive power levels.  A typical implementation would force a device to lower its transmit power when receiving a strong signal from the AP and raise its transmit power when the AP's signal is weak. The unanswered question is, "just how vast are these ranges of transmit power levels?"  Can a smartphone or tablet go as low as half power?  10% power?  0.0001% power?  Those differences could have a major effect on a WLAN infrastructure's ability to handl

You'd think a great company like Apple would care about my privacy BUT NO. Behold, my iPhone: You see what's going on here?  That's my iPhone there.  Apple_57:8d:89.  (Filtered using wlan.sa == f4:f1:5a:57:8d:89 if you're curious.)  And look what it's doing.  IT'S PROBING.  The iPhone of a respected security do-gooder like myself is out there for any hooligan to see. Do I look like the type of person who wants the world to know that I used my phone at the MGM Signature in Las Vegas?  (Well, maybe.  I could've prevented the phone from probing by just tapping on the SSID instead of typing it in.  But typing in SSIDs on iPhones/iPads is a neat trick for keeping stinky captive portal splash pages from coming up over and over again on guest WLANs.)  Or on the VerizonWiFi network at Staples Center?  (Which added a captive portal and lost A TON of guest connections, thus harming overall channel performance for all WiFi users in the arena.)  Why would I wa

Quiet when standing still; active when moving.  That is the way that WiFi devices should treat Probe Requests.  Android devices (at least, Android devices that act like yours truly's Samsung Galaxy Tab 2) probe the right way .  After doing a quick test on the iPhone 5, it appears that Apple has their devices probe based on movement as well. Apple iOS devices have a terrible reputation in some WiFi circles.  The author has heard complaints about mobility, stickiness, throughput capabilities and just about anything else under the sun.  Heck, just today an article was published decrying the throughput ( WHO CARES? ) limitations of of the new MacBook Air (not iOS, but still Apple) was viral'd around the web. To check to see if the iPhone 5 matches the probing behavior of an Andoid device, I associated the iPhone to the office network on channel 36/+1 and started a capture on channel 44/+1.  Then I got up from my chair and started walking around while continuing to use the iPho

When we last left off, yours truly had noticed that an Android tablet was probing for Wi-Fi networks even when associated.  This behavior would have been unusual, as consumer-grade Wi-Fi devices historically would probe when unassociated and stop probing once a connection is made.  After a little bit more investigation, it appears there was an extenuating circumstance that was causing all of the extra probing. I wondered if the Android tablet I have (Samsung Galaxy Tab 2.0 with 65 Mbps 802.11b/g/n WiFi) might have its probing behavior affected by movement, and sure enough it does. I'll try to amend this blog post later to add screenshots of my captures, but for now here is a summary of what I saw: I associated my Galaxy Tab to a WLAN that is on channel 1.  Then I captured on channel 11.  My hypothesis is that an associated device should stop probing on other channels as long as the signal is solid. Sure enough, once I was associated on channel 1, I stopped seeing Probe Req

No bold type introducing today's post, as I'm going to keep things short. I was doing some work last week looking at Android devices (specifically, a Samsung Galaxy Tab 2) and I noticed some very heavy probing behavior.  We were checking out the device's behavior when it moves from AP to AP, so I set a capture for the target second AP.  I did the test (things went fine, but the WiFi Analyzer app in particular seems to really make Android devices stick to their currently associated BSS) and looked at the capture. Seeing a ton of Probe Requests from the Tablet was expected.  What wasn't expected was the Android tablet probing even while associated to the first AP.  Even when the received signal was strong (in the -50 to -63 dBm range), the Android was going off channel to probe and probe excessively. At this point I'm still trying to figure out if physical motion or an app (or lack thereof) caused the probing.  One thing I am pretty confident in saying already