Sniff Wi-Fi

Yours Truly has been worried about the future of WiFi sniffing.  Yours Truly worries about the people (they seem to prefer site surveyors) the software (AirMagnet has yet to support 802.11ac adapters) and the methods (WildPackets has been pushing AP-based capture).  To a person who believes that portable WiFi sniffing is essential for optimizing WiFi performance, it is all very disconcerting.   And yet, there is hope.  WiFi sniffing is ready to step into the 802.11ac/Internet of Everything era, and here is how it can be done. WildPackets OmniPeek has long been the author's favorite WiFi sniffer, but it only runs on Windows.  For years and years and years that was fine.  There were always a few Windows-compatible WiFi adapters that worked great with OmniPeek.  Now, however, WildPackets has gone in a different direction.  They are promoting WiFi sniffing via an AP (which often results in a wor...

So I'm milling around Twitter one afternoon when someone told me that Fluke AirMagnet WiFi Analyzer was overwhelming.  Well, it is if you don't know what to look for.  And since I'm in the midst of developing an online class about WiFi sniffing, I decided to whip up a shabby-looking 10 minute video that might help those who feel overwhelmed. If you like my blog, you can support it by shopping through my  Amazon  link or donating Bitcoin to  1N8m1o9phSkFXpa9VUrMVHx4LJWfratseU Thank you.

When I wrote a blog post recently extolling the virtues of WiFi protocol analysis, I expected some blowback.  Not because WiFi protocol analysis won't help performance (only a Garo falo -ian fool would assert that it won't), but because I touted protocol analysis at the expense of spectrum analysis.   Well, it's time to make amends.  Spectrum analysis is pretty darned useful, too.  And the spectrum analyzer that I use ( Metageek's WiSpy DBx with Chanalyzer ) underwent a notable update in recent months.  Here, then, is an update on Chanalyzer and a reminder of what spectrum analyzers can be useful for. For quite some time Metageek's spectrum analysis suite (consisting of the WiSpy USB adapter and the Chanalyzer software application) has been the thrifty man(and woman)'s tool of choice for analyzing WiFi frequencies.  The original Metageek WiSpy (a 2.4 GHz-only device without an external antenna interface) was a $100 (all prices in USD) USB adapter and ...

Some days you wake up and say to yourself, "how can I be more like Buzzfeed ?"  Buzzfeed is popular and beloved and has an office across the street from a great Mexican restaurant.  I have a few friends and wonderful parents, but I can barely cook a taco.   What is it that I'm missing (besides venture money, a flock of ambitious MBAs and universal scorn from the intelligentsia)?  Lists!  That's what I'm missing.  Hit-trawling, crowd-pleasing lists! So here it is: the first in what hopefully will be a series of one.  A list of Three Simple Ways to Boost Your WiFi.  #LOL #cute #OMG #trashy 1) Add an 802.11n/ac USB adapter to old 802.11a/b/g laptops and desktops. Some folks in the WLAN business like to use the term "5G" to refer to 802.11ac, but I refer to 802.11a/b/g as 1st generation WiFi and 802.11n/ac as 2nd generation WiFi.  The reason I do that is because big improvements to power consumption, receive...

People who do WLAN analysis agree that filtering is a part of sniffing WiFi frames/packets.  More information can be extracted from captures when the focus is on one AP or station or protocol (or a combination of same).  Where people disagree is on which type of filtering is best: capture filters or display filters?  Yours truly is a capture filter man, and some iPhone analysis was a reminder why. Filtering 802.11 captures is covered pretty well in the CWAP Study Guide (of which I am a co-author).  A capture filter extracts frames before  they are captured.  The only frames captured are the ones that match the filter.  A display filter extracts frames after  they are captured.  Every frame is captured.  Then the filter is applied so that only frames matching the filter are shown in the protocol analyzer.  To use the example of a filter on my iPhone, if a capture filter were used then all of the frames from all of th...

QoS the packets of iPad ,  and all through the air  not a station was Probing, not even a hair When suddenly on to my Wireshark screen Appeared Video, Voice and Background, it seemed "But alas", I exclaimed, as I looked at the MACs This is only one tablet, not a bushel or stack To the standard I looked, to decipher the meaning And to you, dear reader, I offer this gleaning The standard in question is dot11e and the goal of its authors was to keep the air free from clutter like YouTube and Facebook or Twitter that might cause your voice conference to lag and/or jitter But remember, dear sniffers, we're still talking WiFi A world where each access point, smartphone and MiFi makes its own way to the channel or not deciding on rates, QoS and the lot So take heed if your WiFI must work for those apps that users just love but treat admins like saps a smartphone may say, "thi...

About a year and a half ago, yours truly wrote about WiFi transmit power levels in iPhones .  Things have changed since then.  And possibly the biggest change (to iPhones, at least) is how aggressive iPhones are in modifying transmit power levels.   In the "Mighty iPhone Power Ranges" blog post, I wrote about the value of setting AP transmit power levels to approximately the same level as client/station device power levels.  Over the past year or so, more and more client/station devices have started using adaptive power levels.  A typical implementation would force a device to lower its transmit power when receiving a strong signal from the AP and raise its transmit power when the AP's signal is weak. The unanswered question is, "just how vast are these ranges of transmit power levels?"  Can a smartphone or tablet go as low as half power?  10% power?  0.0001% power?  Those differences could have a major effect on a WLAN in...