Sniff Wi-Fi

Last week I ran into an age-old problem: my WiFi network being blamed for the poor performance of a neighbor's network. I was pretty sure that the problem wasn't my fault, but how would I prove that? Here are some ways that you can use a WiFi sniffer to diagnose whether your new WLAN is disrupting what's already in place. Let's start with a little background on my situation. I was teaching a class*  at a training location that provides Guest WiFi (unencrypted; no web-based authentication) and optional Dedicated Classroom WiFi (TKIP-encrypted; WPA-PSK authentication). The Guest WiFi was being used by students in my class, but the Dedicated Classroom WiFi was not. Both of those networks were working poorly from the time we arrived. The Guest WiFi being down was just annoying, but the Dedicated Classroom WiFi was a red-level problem. A problem significant enough that we might...

Google recently got in some trouble for the way their wardrivers collect WiFi data for use with location services (Google Maps, for the most part). It looks like this faux pas was just a problem of improper filtering in whatever WiFi sniffer Google was using. If you want to do a little wardriving but you also want to insulate yourself from legal problems if anyone ever gets ahold of your captured frames, make sure you configure your filters properly. Let's start by talking about the differences in wardriving software. Most wardrivers use active scanning software like NetStumbler, KisMAC or Kismet. (I know, KisMAC and Kismet can also do passive scanning, but they are commonly used in active mode.) Active scanners are software applications that keep your WiFi adapter in managed mode, meaning it operates like a normal station. The only difference when you run an active scanner is that discovery information (that being information received from Beacon and Probe Response frames) is...

It's no secret that 802.11n is a peculiar wireless technology. You've got multiple transmissions on a channel, a half dozen technologies and a few dozen data rates (at least) for the average AP to choose from. It can all make for some difficult troubleshooting, especially when looking at data rates. Here's a technique that I use to figure out which 802.11n technologies are missing (or not missing) when I'm trying to figure out why I'm getting a certain data rate. Now, the first question one might ask when analyzing data rates is, what's the point? If I'm using my laptop at my desk and I have a 117 Mbps data rate, I'm not going to move to the break room just to get a bump to 130 Mbps. That is certainly true. But from a networker's perspective, you'd like to give your users the best experience possible, and there may be reasonable changes that would lead to better performance. There are three questions that you can answer by looking at your data ...

The Wall Street Journal wrote today that the iPad is having problems on WLANs at the campuses of George Washington and Princeton. While the GW problem has yet to be described in detail, Princeton's Office of Information Technology has described their problems. The Princeton problem is about DHCP, and it reminded me of another problem that I saw with the iPad's WiFi behavior. First, the background. WSJ.com reported that 20% of the iPad's seen on Princeton's WLAN had been banned for "malfunctions that can affect the entire school's computer system." Then the office of IT at Princeton clarified the issue by saying that iPads continue to use IP addresses after their DHCP lease time expires . This indicates that there is an error in Apple's implementation of DHCP. The reason I decided to write about this is that there is an error in Apple's WiFi that has some relation to the DHCP problem that threatens Princeton's entire computer system (a t...

If you're reading this post, there's a 100% chance that you have heard about the Apple iPad. There's also at least a 50% chance that you have heard about WiFi problems on the Apple iPad . And there's about a 10% chance that you've heard about the deceptive way that Apple markets the iPad's WiFi capabilities. That's what this post is all about. Apple's technical specifications for the iPad say that dual-band (2.4 GHz and 5 GHz) 802.11n is supported. And it is. But what Apple doesn't tell you is that the version of 802.11n built in to the iPad is such that you get almost no speed improvement over 802.11g or 802.11a. To understand what's going on with the iPad's mediocre 802.11n design, you have to understand a little bit about what goes in to 802.11n. There are three 802.11n improvements that bump up the maximum data rate from the 54 Mbps we had with 802.11a/g: more efficient (5/6 instead of 3/4) OFDM coding, double-wide (40 MHz instead ...

I am going to have to expand upon this topic in another post somewhere down the road, but 802.11n continues to annoy me. The technology is revolutionary and inexpensive and blah, blah, blah, but it's dang near impossible sniff it! Oh, does this tick me off. And to make matters worse today I finally got to use my D-Link DWA-160 dual-band 802.11n USB adapter with AirMagnet WiFi Analyzer so I really wanted to do some sniffing. Let's start off with the 802.11n thing first. 802.11n is a great technology that increases both the speed and the range (and even the security, in a way) of your WiFi. Unfortunately for people who dabble in WiFi sniffing, 802.11n also makes it virtually impossible to do traditional sniffing. The problem with 802.11n is that with most setups the Data frames going in one direction will be missed. I don't know exactly why this is and I don't know all of the technical reasons behind it, but trust me, it happens. If you set your 802.11n capture to a ...

I've mentioned in the past that 802.11b has become a thing of the past for most WiFi networks , but recently I happened upon one of these old boys and it worked great. The episode served as a reminder that sometimes you can use old technology well beyond its expiration date if you put it in the right place. You all know the limitations: 802.11b tops out at 11 Mbps. 802.11b stations sometimes lack support for WPA2 (or even WPA). I've never seen an 802.11b device support Block Acks. And many of the don't even support QoS (which is an underrated way to protect yourself against WEP or PSK cracking, btw). But you also know the benefits: they're cheap as heck! There's another reason besides cheapness that 802.11b remains an enticing choice: Sometimes you don't need the extra speed. In my recent excursion I was using WiFi to access a wireless ISP. Initially I was surprised to see 11 Mbps traffic in my Wireshark (I was too lazy to boot into Windows; what's new?...