★ THE BLOG ★ Ramblings on WiFi & stuff.
In case you missed my WLPC Wireshark talk here’s the 802.1X process file… with COMMENTS.😬
It’s just the specific frames in the 802.1X process saved into a separate file with comments for each of the frames. Hopefully, it will give an decent understanding of what is actually happening during this process. ENJOY!
Airtool by @AdrianGranados
Wireshark Most Common 802.11 Display Filters by @VergesFrancois
Wireshark Color Profile via MetaGeek Support
Wireshark for Wireless LANs LiveLessons Video Series by Jerome Henry (@WirelessCCIE) & James Garringer (@JamesGarringer)
WLPC 2019 is upon us and I’m off to Phoenix, AZ. But, first, I got a little shoveling to do. ❄️
Looking forward to seeing all my fellow Wi-Fi nerds and learn some stuff!
I’ll be presenting this year with a short talk on my favorite Wireshark customizations. Nothing too exciting, but hopefully some folks Weill get something out of it.
This will be the first year I will be going to both US AND EU WLPCs! I am really looking forward to my first WLPC-EU where I will be teaching the ECSE course.
I have plans for this year to start putting up more content on a regular basis. Working through some stuff the last few years and I am coming out the other end.
So, #WLPC Peeps, I’ll see you soon! And those of you who couldn’t make it, I hope you’ll be able to do so in the future. I miss you. 😢
For those of you who are trying to decide if it’s worth it, you can view video from ALL the previous WLPCs on their YouTube channel.
I’ll like to tell people that what I REALLY go to WLPC for is the community. Hanging out with folks, making new friends, sharing knowledge, and learning from some VERY smart people.
Videos are great, but PEOPLE are better.
And here’s a detailed whiepaper on 11ax from National Instruments.
Another relatively inexpensive way to pcap on Windows - WLANPiShark: Wireless Capture With a WLANPi on Windows via @WifiNigel
Mike Albano's Client Capabilities List - An oldie, but a goodie, if you haven’t had a chance to check it out (or, contribute to) before.
A nice survey tray alternative - The Swift Body Platform Harness for Laptops & Tablets thanks, @CurtisKlarsen for the link!
How Aruba Optimizes Performance of Dual 5-GHz APs via Aruba Blogs - Good read on the challenges of dual-5gig.
Spectrum Analyzers use this to break down sine waves. Good overview of how it works. - An Interactive Introduction to Fourier Transforms
Driven to Distraction (Revised): Recognizing and Coping with Attention Deficit Disorder - Highly recommended if you feel you are dealing with ADHD. Has had a huge impact on my life.
Ooooooh… this looks nice. Besides looking pretty and offering PoE+, to ALSO has: 12v barrel connect out, and 5V USB out. Now, if they would only add 100W USB-C out. 😏
Good read from TechPlayOn. It’s short and to the point and outlines the differences between 11ax and LTE which has been using and reaping the benefits of OFDM-A for years.
Read the rest of the article at TechPlayOn.
Knowing is half the battle. Understanding how your devices make decisions helps you determine design requirements to build better WLANs. Here’s documentation on how Apple and Samsung devices make roaming decisions.
macOS & iOS Wireless Roaming for Enterprise
Apple was kind enough to provide this information for iOS.
Samsung Knox Roaming Algorithm
Knox is an Enterprise platform for Samsung devices that offers enhanced roaming. Learn how it works to help you support it in your wireless designs.
As a BONUS here’s Apple’s iOS Deployment Guide too!
* Added 04-05-2019
I'm asked all the time how I travel with just ONE bag. So, I made a video!
I am currently on an Around-the-World trip going from Denver to Abu Dhabi to Bangkok to Gold Coast, Australia then back to Denver. This will be about a three week excursion teaching the ECSE Design Course. I have brought one bag for all my items.
I do this for a few reasons: 1. I refuse to check anything. So, I never have lost luggage, 2. I like to move fast. Get through lines fast. Get to my transportation fast - one backpack makes this super easy to accomplish.
DISCLAIMER: On this trip I actually have two bags. One is for all my stuff, the other is for carrying stuff while I am out and about doing touristy stuff. My travel bag on this trip is the Goruck GR2, a 40L backpack. It's way to big to use as my EDC (every day carry) so I did bring my 5.11 Rush10 for day-to-day carry.
So, here is a video I made in my room in Abu Dhabi showing what's in my bag.
HOLD THE PRESSES!!! So, as of Wireshark 3.0, you can do RF Monitor mode captures in Windows using inexpensive NICs. Specifically, the Netgear A6210. Here’s write up on how to set this up, but nothing special is required other than Wireshark 3.0, or newer, and a supported NIC (Netgear A6210).
So, of course, this comes with some caveats. The main one is that this does not support channel information. So, while you CAN set the channel you want to capture on, there will be no data in the capture confirming you are indeed on that channel.
You can go ahead and read the rest of this post, but at this point, why would you? ¯\_(ツ)_/¯
In Windows, you cannot effectively analyze wireless frames, because you are unable to put the wireless NIC in "RF Monitor Mode" - that is the mode in which the wireless NIC can see ALL 802.11 frames in the air, not just ones intended for itself.
Historically, it's been an expensive proposition. There are some great tools out there like OmniPeek (which I use), the gold standard for Windows packet analysis. And for years, AirPcap Nx was the main NIC folks used for pcap'ing WLANs with Wireshark. Unfortunately, both options are pricey. And the AirPcap NX is no longer manufactured. You’d be lucky to find a used one on eBay. Linux and MacOS have been the only ways to cheaply get access to RF Monitor mode without spendy software and hardware, like Omnipeek and the AirPcap Nx.
But, not everyone uses Linux, or Mac OS. Fortunately, and fairly recently, there are more and more ways to get RF Monitor mode in Windows. Here are some relatively inexpensive options (NOT an exhaustive list) to perform an RF Monitor Mode wireless packet capture in Windows using relatively inexpensive hardware.
Acrylic Wi-Fi Pro ($45)
MetaGeek Eye P.A. now supports native Windows Monitor Mode! - (List of supported NICs) ($800.00 US) Also, will soon have support for WLAN-Pi!
OmniPeek ($2k +)
NEW! @WiFiNigel's blog on how to turn a WLANPi into an external packet capture device for Windows ($75 US) cab be purchased here.
OR, you could just get a Mac and do it natively. 😉
Lastly, if you have access to an Ekahau Sidekick, and you have an Ekahau Connect account, you can use the Sidekick to perform offline packet captures, and you can even have each NIC capture on a difference channel! Cool!
Here are some additional resources for wireless picture capture in Windows from @Ron_van_Kleunen:
* If anyone has additional relatively inexpensive options for this list please DM me @HeyEddie.
I don't know. Less than a grand? Less than $500? Please don't get all pedantic on me. 😉