Sniff Wi-Fi

The iPhone 5 is a chatty device.  How chatty?  I checked, and it is chattier than I thought. Yours truly has done more WiFi sniffing of iPhones than yours truly cares to recount.  What has always stood out about these captures is the amount of chatter than an iPhone seems to engage in. I did a little test of my unlocked iPhone 5 to see exactly how chatty it was.  The test involved me turning on the phone's screen, spending a second looking at iMessage (which happened to be the last app I was on when the screen was turned off), pressing the Home button, opening the Twitter app (because, after all, if you're not on Twitter these days then you're not wasting your time properly) and refreshing my Twitter feed. The test took about fifteen seconds.  My capture saw WiFi frames going to or from my phone for about 17.64 seconds (rounded up to 18 for the purposes of a catchier blog post title).  Here is what it looked like: The good news is that my phone...

Fear not your sniffers, dear WiFi folk.  For they are your path to the truth. I had a conference call today and the topic of carrier devices (smartphones, 3G/4G enabled tablets, etc.) on Wi-Fi networks came up.  The person on the other end needed to make sure that his WiFi devices were optimized for a variety of different WLAN infrastructures. My first reaction (as is my first reaction to most WiFi related topics) was to sniff.  First set up the infrastructure.  Then use the device (which could mean connecting, roaming or running an app).  Then sniff what's happening.   His reaction to my sniffing idea was pretty negative.  Their testing procedures are basically trial & error.  Set up the WLAN, then connect the device and then document what the user experience is.  If the user experience stinks, then make a change.  He was a sniffophobe. I get why people are sniffophobes.  WiFi sniffers can be expensive and diffi...

A bunch of WiFi vendors made presentations at the Wireless Field Day events a couple of weeks ago, and the one that piqued my interest the most (at least in a positive way) was WildPackets'.  The WildPackets OmniPeek software can now sniff 802.11ac traffic, with a catch.  The catch?  It only sniffs single streams 802.11ac traffic.  Is that a useful thing? First things, first: In order to sniff 802.11ac traffic, you need a AE6000 (Linksys Wireless Mini USB Adapter AC 580 Dual Band)  adapter.  (And if you decide to buy one and want to support this blog, you can use that link to Amazon.) The AE6000 adapter is a single stream 802.11ac adapter with a Ralink chipset.  WildPackets is developing a driver for the Ralink chipset and demonstrated the AE6000 in action.  The expectation is that it will be a month or two before the OmniPeek drivers for the AE6000 actually get released, but I bought one so that I'm ready. Being able to sniff 802.11ac tr...

WildPackets has a sizable discount for OmniPeek Professional right now if you bundle it with three OmniWiFi 802.11a/b/g/n 3-stream USB adapters.   WildPackets OmniPeek has long been my favorite WiFi sniffer, and the OmniWiFi USB adapter is currently my favorite capture device.  So getting a package of OmniPeek Pro with three OmniWiFi adapters at a $900 discount would seem to be an awesome deal, right?  Sort of. There are several versions of WildPackets OmniPeek , and for the most part the more expensive versions add features that are far more useful for wired sniffing than for wireless sniffing.  One look at the OmniPeek comparison chart reveals that the Compass screen and roaming testing are the only features that could possibly maybe justify a WiFi person spending $3,000 (discounted to $2,400 as part of the deal referenced above) on OmniPeek Pro rather than $1,200 on OmniPeek Basic. Compass is nice , and if you have a relatively large budget for ...

The 802.11v amendment has been voted, stamped and added.  It is part of the 802.11 standard.  We still are unsure if we'll ever see it, but if we do it could ease some concerns about high-density WiFi. Wireless Network Management is its name, and not being adopted is 802.11v's game. Wireless network management (WNM) is an addition to the 802.11 standard that puts more control in the hands of admins.  Today, the client/station controls everything: roaming, load balancing and congestion avoidance included.  WNM is designed to put that stuff in the hands of the infrastructure (APs, controllers and management software). Companies that sell client/stations have (predictably?) declined to adopt WNM thus far.  That means that admins will continue to have to wait for the ultimate careful-what-you-wish for WiFi technology. There is, however, one part of WNM that is separate from the move to infrastructure control: Multiple BSSID Beacons.  APs have supported...

Today it was announced that 7 Signal  would be a first time presenter at Wireless Field Day in August.  7 Signal offers a product that uses distributed sensors that analyze a WLAN. Wait a moment.  This sounds familiar... It was a mere fifteen months ago that yours truly spouted a  negative opinion of distributed sensors for WLAN analysis and troubleshooting.  To be precise, distributed sensors were accused to producing a worthless capture. A company like 7 Signal, then, offers both good news and bad news. The Good: People are starting to care more about WiFi sniffing and analysis.  A company like 7 Signal can only exist if networking folks appreciate the value of seeing what it happening in the air. The Bad: Distributed sensors produce worthless captures.  Does it matter if a 7 Signal sensor can connect if an iPad cannot?  Does it matter if good channel quality is seen at the ceiling (where the Sapphire Eye sensors are supposed to be m...

As long time readers of this blog might know, WildPackets OmniPeek has been my favorite WiFi sniffer for nearly a decade.  Then I found out about WildPackets' OmniWiFi 3-stream 802.11n USB adapter and I fell even more in love.  Now I learn that OmniPeek 7.5 has added wireless features to the Compass screen.  A good product has been made better (though time will tell if it lasts). First, OmniWiFi: The fact that different 802.11n devices have different capabilities is one of those things that sometimes flies under the radar.  The standard may say 600 Mbps, but just on the Apple website one can buy 802.11n devices with maximum rates of 65 Mbps (iPhone 4S), 150 Mbps (iPad Mini), 300 Mbps (Macbook Air 2012) and 450 Mbps (Macbook Pro 2012). 450 Mbps WiFi devices are the ones that give WiFi pros trouble because so many sniffing tools fail to capture 450 Mbps traffic.  The popular (at least with Wireshark devotees) AirPcap NX from Riverbed, the beloved (at least b...