Wireless PCAP Problem

For want of a nail the shoe was lost.
For want of a shoe the horse was lost.
For want of a horse the rider was lost.
For want of a rider the battle was lost.
For want of a battle the kingdom was lost.
And all for the want of a horseshoe nail.

At WiFi Trek2016 the discussion of Wireless Packet Captures with 4 or more spacial stream AP(s) was discussed. Currently, I use a Mac Book Air and the program Airtool to take a packet capture and then analyze it in Savvius OmniPeek. The Mac Book Air has the capability to see up to three spacial streams. What happens when a new site is deployed with Cisco 3800 series AP(s) with four spacial streams? How do you capture those packets?

Certainly one way is to use a Cisco 3800 series AP as a sniffer tool. But another way is to disable the spacial streams of the radios down to three or two. This is a disruptive change, but it can be a work around if you need to see the traffic.

shot1

What are your thoughts on the topic? Do you have another plan or idea? Let me know!

 

 


4 thoughts on “Wireless PCAP Problem

    1. The Cisco 3800 data sheet lists the AP as 4×4 but further down it does say it is capable of three spacial streams. As for MacBook Air it seems the information is a bit less definitive. Best bet is to check the radio and chipset docs.

      You could be totally correct. Thank you for responding!!! I always try my best to verify my documents and information but writing a blog is not my full time gig so I only have so much time. Feel free to make suggestions any time!

      Like

      1. No problem fella, I think the 3800 is 4×4:3 for an extra antenna to assist in client link. I know my 2015 MacBook Air is crippled, a 3×3 chipset with a radio shut off giving me 2×2:2 :-/

        Liked by 1 person

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s