pointer

The Challenges that Arise in Monitoring 802.11ac Equipment

In our last blog post, we wrote on the Wi-Fi Alliance’s 802.11ac certification program and how it helps both the consumer of wireless equipment as well as the distributor of wireless equipment.

This week, we want to focus on the process of monitoring your new 802.11ac equipment once it’s installed. Before you can monitor 802.11ac traffic, you need to be able to capture the traffic. This is true regardless of the monitoring solution used, and capturing 11ac traffic remains one of the biggest challenges with this new technology.

Let’s take just a moment and step back to see how this has been done with 802.11a/b/g/n. Wireless LAN monitoring did not come without its struggles in these bands either, but over time the industry settled into a comfortable solution using laptops with 802.11 USB WLAN adapters. This solution is highly portable, making on-site WLAN analysis easy, regardless of the location. Most solutions work with only a subset of available USB WLAN adapters, and some require a custom adapter. In either case, the key requirement is that the WLAN adapter be able to be put into “promiscuous mode,” sometimes called sniffing mode. If this capability is not exposed in the device, then it has no chance of being used as part of a WLAN network monitoring and analysis solution. This combination remains as the “go-to” solution for most WLAN analysts, both in the field and in corporate WLAN environments.

So, what’s changed in 802.11ac? Let’s take a look at a few key differences between 11ac and previous technologies that are making WLAN monitoring and analysis more difficult.

Timing/Availability
Let’s face it, 802.11ac is brand new, and with that comes all the issues of timing and availability that may not always coincide with a perfect and logical order. Hardware vendors need software to test the new devices. Software vendors need hardware to test their software before they can provide it to hardware manufacturers. It is a classic “chicken and egg” scenario. As we described earlier, WLAN analysis software needs supported WLAN USB adapters to collect data for analysis. Without supported adapters, the software cannot be developed and tested, at least not fully. This is starting to ease, as more adapters from more vendors are starting to hit the market, some of which are compatible with promiscuous mode and can be used for wireless packet capture. As with previous 802.11 specifications, the situation will improve, but it’s always a painful process at the beginning.

Breaking the “Gigabit Barrier’
802.11ac is the first wireless standard to break the “gigabit barrier,” delivering wireless connectivity at data rates in excess of 1Gbps (in some modes). If you recall, it wasn’t all that long ago (OK, at least for us old guys) that we were talking about 1Gbps wired speeds. Breaking through this barrier requires some adjustments in the way we capture and analyze wireless data. First, back to our USB WLAN adapters. The key word here is “USB.” The laptops most of us have probably support USB v2.0. That means a maximum theoretical throughput of 480Mbps, with a practical limit less than 300Mbps. The slowest typical 802.11ac connection will be at 433Mbps (1-stream and 80MHz bandwidth). So it’s pretty clear that USB v2.0 is not up to the task. USB 3.0 will do in most cases, but you need to make sure that both your laptop and your 802.11ac WLAN USB adapter (that is compatible with your analysis software) are USB v3.0 compliant. It’s looking like some hardware upgrades may be required soon…

And it’s not just about the devices. Network analysis at greater than 1Gbps can be very demanding in terms of CPU and memory, and the software itself must be up to the task. Many are not; we already know this. Fortunately our OmniPeek network analyzer is up to the task since it’s been doing multi-gigabit wired analysis for many years now.

There are alternatives to USB WLAN adapters for capturing data, and we highly recommend that users begin thinking in this direction. The best approach is to use an AP to capture wireless data. APs are typically more capable than USB adapters (think more streams and better optional feature support) so they are best suited to the task. If you use the same brand for capture that you plan to use to send data, then the feature set compatibility will be guaranteed. Again, just as with USB adapters, you need to ensure that the AP can be put into promiscuous mode. Most enterprise APs can (but not all), and most consumer-grade APs cannot. Remote Pcap support is the best bet for using an AP as a packet capture device. We know, this makes portability a bit more of an issue. You may need to find a plug and be a bit more stationary when capturing data, so you can plug in your AP “sniffer.”

Staggered Feature Roll-outs
The 802.11ac specification is still in draft form, and the biggest risk at this point is equipment that doesn’t yet support the feature set you expect, even if the feature is “required” by the spec. The Wi-Fi Alliance (WFA) has just started interoperability testing against the draft spec so this should help a great deal in eliminating the uncertainty, but until the specification is ratified any equipment you plan to buy to be used specifically as part of a WLAN analysis set-up should be carefully researched to be sure that it will meet both your immediate needs as well as those down the road after ratification.

802.11ac shows major promise in the industry, but getting yourself ready to be able to monitor and analyze the new equipment is a bit of a challenge. Patience is essential in this process, as is ensuring that the solutions and equipment you buy will be compatible with a long future of 802.11ac wireless analysis.

Leave a Reply