Introduction
A video demonstration is available [Video] - Windows Acrylic Wifi Scanner.
Basic WiFi analyzers or "stumblers" can provide a lot of useful information for troubleshooting common wireless problems. Coverage, performance, and connection issues can sometimes be resolved simply by using basic, and often even free, tools to get a guick and general idea of the radio frequency (RF) environment.
There are a number of free or low-cost applications. The right application will depend on the platform (mobile, laptop, etc.) and operating system (OS). A few common analyzers include:
- Acrylic Home Edition (Win)
- InSSIDer (Win/Mac/Android)
- NetStumbler (Win)
- iStumbler (Mac)
- NetSpot (Mac)
- WiFi Analyzer (Android)
Mac users also have built-in tools available. Hold the Option key and click the WiFi icon, then click Open Wireless Diagnostics. Next, select Scan from the Window menu. For more information see the Apple support document Check for Wi-Fi issues using your Mac. Linux users can try kismet or LinSSID. While kismet is a commonly referenced utility, LinSSID is more like the other options listed above.
It is important to understand that these utilities have some pitfalls. Professional grade equipment will generally include hardware which makes power level readings more reliable and sometimes even provide the ability to see raw RF levels. The tools described here simply use whatever wireless chipset is available in the device. Power readings may not be consistent across devices, and in general, they may not be completely accurate. Further, non-802.11 RF interference sources such as cordless phones or microwaves will not show up. For the basic purposes of quick troubleshooting, these readings are a good starting point. However, some problems will require professional grade equipment to resolve.
Since Windows is a fairly ubiquitous OS and Acrylic Home Edition is free, we will use this software to provide a brief overview of how to gather some basic information.
Gathering Basic Information
Regardless of the application used, the information we want to gather is the same. It is a good idea to gather these are four (4) primary items from multiple locations around the site or problem areas.
- SSID
- BSSID (MAC Address)
- Signal Strength
- Channel
Most WiFi analysis will benefit from a detailed and scaled floor plan with AP locations marked. At the very least, a sketched floor plan with approximate AP locations is generally required. As the above information is gathered, it is important to thoroughly mark on the map where reading where taken, and the results should be saved such that they can be easily referenced. For example, screenshots can be named with a number appended to the filename, and those numbers can be written on the map. This will help make better channel and power plans, and it can also help identify the location of hidden or rogue APs.
The service set identifier (SSID) is the WiFi network name that we see when connecting our devices. The basic service set identifier (BSSID) is the MAC address of the virtual access point (VAP) supporting that SSID, and it is common for the BSSID to be very close to the Ethernet MAC address of an AP. This is a simplistic explanation that will be made more clear in the examples below. In addition to these IDs, we also want to get channels and power levels. Figure 1 shows the basic layout of Acrylic. Acrylic has two panes: the top pane is a network list and the bottom pane contains graphs. The first four (4) columns in the top pane provide the common parameters listed above. Earlier we mentioned that the BSSID is the MAC address of a VAP. Acryllic simply uses MAC Address for the column heading, so let's focus on the top entry to explain this further.
Figure 1. Acrylic Overview and Signal Strength
Each AP will have an Ethernet MAC address which is used on the wired side of the AP, and for each SSID that same AP will create a VAP interface. The MAC address (BSSID) for the VAP will be built off of the Ethernet MAC address. The MAC address of the top entry is 00:19:92:3C:F6:E1. If we log into vWLAN and check the Access Point Status page, we can use that BSSID to find this same AP. In vWLAN we see the Ethernet MAC address 00:19:92:3C:F6:E0, but also note that AP is assigned 2.4 GHz channel 11 and 5 GHz channel 149. If we look back at Acrylic we can see that the second entry, 00:19:92:3C:F6:E9, is on channel 149. In other words, we can use the MAC address from Acrylic to identify an AP in vWLAN (or vice versa), and now we know the closest AP to where we took the readings. The vWLAN Access Point Status page is shown below.
Figure 2. vWLAN Access Point Status Page
Channel Examination
Acrylic and other WiFi analyzers are probably best equipped to provide basic channel examination. This provides a view of the frequency space for each band. This might also be considered a channel view as it shows each BSSID centered on a specific channel. The bottom pane of the Acrylic window has four (4) tabs.
- Signal Strength
- Network Quality (not available in free edition)
- 2.4 GHz APs Channels
- 5 GHz APs Channels
These views can help identify the best channel for a new AP, whether or not a specific channel is overcrowded, or help identify which AP provides the best signal in a certain area. We can select a BSSID in the network list and Acrylic will fill in the same BSSID on the channel graph. This also adds a black line showing the signal strength for that particular BSSID. So, if we know the already know location of the APs, we can use this data to confirm our current channel and power plan. We can couple this data with the channel utilization data from the AP status details provided in vWLAN to decide if new channel assignments are required. Or if we are trying to locate a rogue or hidden AP, we can select the device and begin to walk around watching the signal strength.
For the channel examination we will select either the 2.4 GHz APs Channel or 5 GHz APs Channel tab.
2.4 GHz Channels
Figure 3 shows the entire Acrylic window with the 2.4 GHz APs Channels tab selected in the bottom pane. Figure 4 focuses in on just the 2.4 GHz APs Channels graph. It also helps easily identify an AP that is not on channels 1, 6, or 11.
Figure 3. 2.4 GHz Channels
We can use the channel graph in Figure 4 to make another important point about the 2.4 GHz channels in general. The smallest possible channel width is 20 MHz wide, and we can see the center frequency of each channel either above or below the graph. For example, channel 6 is centered at 2437 MHz (or 2.437 GHz). This means that for a 20 MHz wide channel, the edges of channel 6 span from 2427 MHz all the way to 2447 MHz. So channel 6 actually overlaps with channels 4 through 7, further we see that only channels 1, 6, and 11 are the non-overlapping channels in the 2.4 GHz range. Overlapping channels can trigger the carrier sense mechanisms of wireless devices thus preventing those clients from transmitting. While that is beyond the scope of this discussion, it is important to avoid overlapping channels. This also implies that only channels 1, 6, and 11 should be used if the 2.4 GHz range is required.
Figure 4. 2.4 GHz Channel Graph
5 GHz Channels
As opposed to the 2.4 GHz band, each channel in the 5 GHz range is separated by 20 MHz. This means that 5 GHz channels essentially have no overlap for the purposes of this document. Notice also that there are many more 5 GHz channels in general, although each country may regulate these channels differently. Another observation we can make is that the ADTRAN WiFi network spans channels 149 and 153. That indicates this network is using two bonded channels to make a 40 MHz wide channel. This is confirmed in the network list as seen in Figure 5.
Figure 5. 5 GHz Channel Graph
Signal Strength
Acrylic provides signal strength as RSSI. This can be seen in the third column of the network list pane. The received signal strength indication (RSSI) value is a measure of received signal power. RSSI values vary between devices, and often times are arbitrary positive numbers based off a set noise floor value. However, Acrylic converts the RSSI to dBm, but it should be noted this is still a value read from the wireless network adapter in some way. The way these numbers are generated is typically hidden from the user, and so even though they are very useful, they should not be considered highly accurate.
Acrylic also provides a signal strength timeline as seen in the bottom pane of Figure 1. This can be useful for identifying periodic RF interference. For example, large dips in the signal level around 12pm might indicate interference from a nearby microwave although additional tools would be required to actually confirm this theory. The Signal Strength graph could also be useful for determining an estimate of the noise floor. Notice in Figure 1 that the graph gets extremely cluttered below -70. Let's say an employee in their office only receives about -75 from the AP. Readings over time also suggest the signal level is usually below -70 throughout the day. This particular user may experience slow speeds as they constantly have to retransmit data or contend for the medium.
Notice that some networks do not have a colored square beside the name. The colors of the squares help identify the same network in the graph, and we can click the square to remove that network from the graph as well. It might be useful to sort by MAC Address and remove additional SSIDs from the same AP. In other words, if a single AP were to broadcast three (3) unique SSIDs, then it might be helpful to remove two SSIDs from the graph. Just make sure for dual-radio APs that at least one SSID from each radio is in the graph unless the goal is to troubleshoot a single band or even channel as described below.
