Sniff Wi-Fi

The darned computer (or phone, or tablet) won't connect. We've all been there, and we've all wondered what the heck the problem is. Here's a quick way (using an OS X 10.7 [Lion] Macbook Air with Wireshark) to start yourself on the road to figuring out why. Last week I put out a call for blog topic suggestions and my man Keith Parsons made the fine suggestion of going through some tips for troubleshooting using Mac OS X. I think that is a good idea, so here is a little bit on troubleshooting connection problems on my (and the unemployed screenwriter industry's) favorite operating system. If you understand 802.11 protocols , then troubleshooting connection problems can be done at an extremely low level. When your (or the people you support's) WiFi connection seems to be unavailable for no reason, you can look at the frames being sent to see if things are going the way they're supposed to. When working with a Mac, I use Wi-Fi Diagnostics (an OS X Lion-on...

FINALLY! If you do a lot of sniffing, there is a chance that you have a bag full of USB adapters whose contents look like this: Riverbed AirPcap NX Metageek WiSpy DBx D-Link DWA-160 Cisco-Linksys WUSB600Nv1 D-Link DWL-122 D-Link DWL-G122 Ubiquiti SR71-USB (w/ two HG2401RD-MMCX 2.4 GHz antennas) I do, and it stinks . AirPcap is for Wireshark, WiSpy is for Chanalyzer, the DWA-160 and SR71-USB are for AirMagnet software, the DWL adapters are for Kismac and the Cisco-Linksys is for OmniPeek. It is a bit frustrating, especially if I need to switch between applications. Well, today I am a happy(er) man.  The screen in that shot is WildPackets OmniPeek, running like a champ. And do you see that little thing on the right, there? That is the D-Link DWA-160, working with OmniPeek like a champ. It is a little thing, I guess, but I am very happy to be able to use the DWA-160 adapter with WildPackets OmniPeek. This means that Fluke Networks' Air...

The darned computer (or phone, or tablet) won't connect. We've all been there, and we've all wondered what the heck the problem is. Here's a quick way (using an OS X 10.7 [Lion] Macbook Air with Wireshark) to start yourself on the road to figuring out why. I'm on a connection kick as of late, so let's follow up the last post on this blog by going into a little more detail about WiFi connections. If you understand 802.11 protocols , then things can be taken a little deeper. When your (or the people you support's) WiFi connection seems to be unavailable for no reason, you can look at the frames being sent to see if things are going the way they're supposed to. Now, I was in a little bit of a lazy mood today, so I decided to use the OS X Lion application called Wi-Fi Diagnostics and Wireshark rather than a professional tool like WildPackets OmniPeek or Fluke AirMagnet WiFi Analyzer. This same stuff can be done (and, in fact, can be done even easier)...

We've all encountered bad WiFi networks in the past. Is there anything (besides cursing the admins) that can be done about it? There is a fantastic phrase going around nowadays that is used to describe all manner of first-world problems: white whine . Complaints about the quality of guest WiFi certainly would fit into that unfortunate category, but I'm going to join the white whiners anyway (while throwing in a few helpful sniffing tips so that I feel better about myself). UFC 137 happened on October 29, 2011 at the Mandalay Events center in fabulous  Las Vegas, NV, and I was there covering the show for the Wrestling Observer . As is the case at almost all sporting events nowadays, WiFi-based Internet access was provided to the media in order to enable live blogging, tweeting and general reporting on the event. As is also the case at many sporting events nowadays, the WiFi stunk. In fact, it sucked. (And I don't use that term loosely. My mother would be angered at my p...

Channel choices can be a tricky thing, especially in the 2.4 GHz frequency band. I saw a network recently that had an unconventional channel design, but the network seemed to work pretty well. Channel selection has long been a peculiar topic for 2.4 GHz WiFi networks. Per-channel frequency allocations in the band are 5 MHz wide (enough for a cordless phone or PowerPoint clicker, for example), but transmissions are much wider. The exact amount of bandwidth taken up by WiFi devices varies depending on the standards supported (802.11 b, g or n), the radio's transmission power and possibly other mysterious factors as well. (Just try running a spectrum analyzer around gear that supports transmit beamforming (TxBF) and you'll see what I mean.) A seasoned rule of thumb has been to keep APs running on channels 1, 6 and 11 in an environment that supports ubiquitous coverage. The theory is that, at typical transmission/antenna configurations, WiFi devices will transmit over bandw...

The Metageek spectrum analyzer package ( WiSpy hardware with Chanalyzer software ) has long been a favorite of thrifty sniffers. It has long deserved some praise from this blog, and with Chanalyzer 4 melting steel like a CM Punk promo , now is a good time to give it. For many years spectum analysis was overlooked or even ignored by WiFi professionals, and for good reason. If you were managing a wireless network back in the days of 802.11b (or even the early days of 802.11g), there was a paucity of good, affordable spectrum analysis tools. You could buy a hardware analyzer (I first used something similar to  this beast ), but those things were usually expensive and designed as general purpose analyzers rather than WiFi-specific analyzers. Spectrum analysis changed for the better in 2005, when Cognio released the Spectrum Expert analyzer. Their PC Card/software combo immediately became a favorite of WiFi folk and remains one today (though the product is now the Cisco Spec...

I believe in sniffers. I believe in planning for client roaming. And I believe that mixing the two is a bad idea. Using a sniffer the right way and planning for client roaming the right way are both essential for having a high quality WiFi network, but it's a good idea to keep the two separate. This is, of course, a blog about WiFi sniffing, but to understand why using sniffers to plan for roaming is trouble, let's go into some background on WiFi client roaming. WiFi (802.11) networks were designed like cell phone networks in that client stations would be able to maintain application connectivity while moving between access points. They were also designed to be unlike cell phone networks in that the client station would control when roaming happens. You see, in cell phone networks, the network infrastructure controls when your phone moves to a different base station. That design makes sense because cell phones have a built in way of giving base stations information about the...