Sniff Wi-Fi

  Show  of hands: Who here has seen Retry percentages above 90%? If you work with Wi-Fi, your arm is likely reaching skyward as if you're hiding Darrell Lea licorice from the kids. (Hope you wore deodorant today.) Juniper Mist is most notorious for it. Nyansa Voyance -- which is no longer a Wi-Fi thing -- used to do it too. Aruba Central even has a built-in alert for it. The problem is, 90% retries doesn't really exist (and of course, 100+% retries is impossible). When an AP repeatedly sends retransmitted frames (packets) to a Wi-Fi client -- and let's pause to point out that centralized WLAN management systems can only reliably know AP-to-client (not client-to-AP) retry statistics -- the AP will typically drop a packet before re-sending it so  many times that the wireless retry percentage would ever truly hit 90%. So why, then, do we see retry percentage near, at or above 90%? Because some (most?) Retry% calculations often use a denominator of successful  frames instead o

If there's one recent change in the Wi-Fi world that has brought some heat and light to your humble blogger's cold, dark heart, it's the awareness of device differences.  But there's a difference between understanding that Wi-Fi devices have differences and creating an infrastructure that supports them.  And an important step in setting up a good Wi-Fi infrastructure is finding out whether the APs' transmit power is too high, too low or juuuuuuust right.  It has long been the recommended to have matching transmit power for devices engaging in two-way wireless communication, but with Wi-Fi that rule is often broken.  Breaking the rule is understandable because Wi-Fi environments are often vendor-neutral.  Most Wi-Fi deployments are not like the beaches of Normandy, where everyone had the same model of radio. Sometimes we need really, really good Wi-Fi, and matching the transmit power levels of APs and stations can go a long way towards fulfilling that need.  Ma

If there's one thing we've learned about WiFi over the years, it's that problems get fixed.  Site surveys used to be sooo annoying.  So we got controllers with auto-RF.  Guests used to complain and complain that we didn't have WiFi for them.  So we got captive portals.  And so the worl-- Wait a minute.  Auto-RF really doesn't work and we still need site surveys.  And captive portals annoy our friends in desktop support as much as they annoy our guests, plus they drag down overall WiFi performance.  Hmmm...  Let's start over: If there's one thing that we've learned about WiFi over the years, it's that sometimes what seems like a good solution to a problem only ends up making things worse.   Which brings us to our latest solution-that-only-makes-things-worse: Dual-radio APs with band-selectable radios. A little background: Last week, I was sitting in an office, minding my own business when I got a call.  A friend of mine who works in WiFi ha

So I'm milling around Twitter one afternoon when someone told me that Fluke AirMagnet WiFi Analyzer was overwhelming.  Well, it is if you don't know what to look for.  And since I'm in the midst of developing an online class about WiFi sniffing, I decided to whip up a shabby-looking 10 minute video that might help those who feel overwhelmed. If you like my blog, you can support it by shopping through my  Amazon  link or donating Bitcoin to  1N8m1o9phSkFXpa9VUrMVHx4LJWfratseU Thank you.

As long time readers of this blog might know, WildPackets OmniPeek has been my favorite WiFi sniffer for nearly a decade.  Then I found out about WildPackets' OmniWiFi 3-stream 802.11n USB adapter and I fell even more in love.  Now I learn that OmniPeek 7.5 has added wireless features to the Compass screen.  A good product has been made better (though time will tell if it lasts). First, OmniWiFi: The fact that different 802.11n devices have different capabilities is one of those things that sometimes flies under the radar.  The standard may say 600 Mbps, but just on the Apple website one can buy 802.11n devices with maximum rates of 65 Mbps (iPhone 4S), 150 Mbps (iPad Mini), 300 Mbps (Macbook Air 2012) and 450 Mbps (Macbook Pro 2012). 450 Mbps WiFi devices are the ones that give WiFi pros trouble because so many sniffing tools fail to capture 450 Mbps traffic.  The popular (at least with Wireshark devotees) AirPcap NX from Riverbed, the beloved (at least by yours truly) D-Lin