Learning about RF Spectrum Analysis with Metageek

This week I wanted to talk about the first vendor to present at Wireless Tech Field Day, Metageek. I have had one of their Wi-Spy 2.4x products for several years as my good friend Douglas Haider @wifijedi (Go visit his blog, the link is just there on the right!) gave me it when he had been given an extra one. I used it for a while mainly to learn what different RF signatures looked like and to troubleshoot customer problems. I found Ryan and Trent from Metageek to be well, geeks like me and their presentation was liked by all at WFD. They started off with a presentation about how and why Metageek got started then launched into going over the capabilities of their products. I won’t go much into their presentation here as it has been covered very well by some of the other delegates at WFD, this page at Revolution Wi-Fi provides a good list of all the articles.

My main intent in writing this was to highlight Metageek as a learning tool to learn RF spectrum analysis. The reason for this is that I know many of you will not have the money to purchase the Air Magnet product or even (if you can still get one) the Cisco Cognio product and may be very well asking yourself if you will be able to get the job done and learn what you need to know with Metageek’s Wi-Spy. I would say most definitely yes to this question and what’s more even though you may later be able to purchase one of the other companies products you will still find the Wi-Spy to be incredibly useful in your job as a WLAN engineer.

Wi-Spy Gear

The difference between Wi-Spy’s approach to Spectrum Analysis and the other manufacturers was described by Ryan of Metageek as that Wi-Spy takes little snapshots quickly across the spectrum to build its view of what the RF signal looks like whereas the others take larger chunks or bites of data to see what is there. There are advantages to both approaches in that you get slightly different views on what is going on in the RF world. Primarily what you are doing in using a spectrum analyzer is looking at a pictoral representation of a signal that you can’t see with your own eyes. Products like Wi-Spy use colors to highlight different interpretations of the data and also waveforms so that you can get some idea of the patterns that regularly show up in this type of RF data.

Wi Spy ChanPro4

If you look at the above screenshot of Chanalyzer Pro you will see right away, even without knowing what is being represented, that there is a large amount of RF data in the center of the screen. This was me turning on a microwave in order to show how this affects the RF signal. If you look a bit closer at the top, you will see this data is being represented in a slightly different way. Imagine that the center graph is you looking down at a waterfall of this RF data going by. The graph at the top is a slice of the data below turned horizontally so you can pick out more easily the relative energy levels of the signals and see the patterns of RF data. I have overlayed some other aspects onto the top graph so you can, for example, pick out the SSIDs but this is the essence of spectrum analysis, to be able to pick out patterns from the RF and use those patterns to have an idea of what type of device might be interfering with the Wi-Fi signal. Metageek has designed their products so that you can quickly see the patterns and start to recognize them and even provides ‘signatures’ to help you learn. This is very powerful.

Wi Spy Chan4

More than likely, if you either have a Wi-Spy or purchase one to learn about spectrum analysis, you will get the free version of Chanalyzer that comes with the product. As you can see in the screenshot above it has that same powerful visual representation of the RF data that its bigger sibling does. The advantage of the Pro version is that it allows you to quickly move back and forth across a large set of data and find the interesting bits to look at and that it includes a screen that represents duty cycle. Duty cycle is a representation of how busy a particular frequency is and how much a signal is using that frequency. By the way, if you just want a quick free product to look at the Wi-Fi signals around you then you can’t go wrong with InSSIDer, shown below. To me graphs are so much nicer to look at than Netstumbler lists of AP signal strength.

Wi Spy Inssider

As you can see a very important component of becoming a WLAN engineer is learning how the RF spectrum works. We use the unlicensed bands of 2.4GHz and 5GHz for our day to day WLAN communications and as such these frequencies are quite often used by other devices. Anyone who runs a wireless network in a hospital will be quite familiar with those areas where the 2.4GHz band just will not work and its usually due to some medical device that is needed and has been in the hospital for a number of years. You may also have heard that the 2.4GHz band is becoming crowded. Products such as Metageek’s Wi-Spy and Chanalyzer give you a way to see the RF spectrum as you may never have seen it before.

I had not been able to really work with Chanalyzer Pro before Wireless Tech Field Day and I must admit it was an oversight on my part. The presentation Metageek gave to us was at just the right level. It showed me why I should use Wi-Spy in addition to the tools I already have (as I explained in my last post) and what the technical differences were between the way Metageek approaches spectrum analysis and how almost everyone else does it. Even if you can only afford to purchase the Wi-Spy 2.4i you will gain a great deal of knowledge as to what different patterns of interference looks like in the RF world and you can begin to gain a wider vision of the world of RF.

I am a strong believer that one day wireless networks will become so ubiquitous that anyone learning to be a network engineer will also need to learn about WLANs as part of their study. In order to really understand wireless networks you need to understand RF and spectrum analysis. It’s fun for me to sit and watch a screen showing microwave interference such as you saw above (while the microwave heats the water so much it goes all over the place). I also have a lot of fun tracking down what a mysterious signal is that is interfering with my network. This is part of the fun of being a WLAN engineer, you actually get to become part detective in your job. Pretty soon you will be so good at it you can go take the Certified Wireless Analysis Professional (CWAP). I will be myself pretty soon and I am looking forward to proving that I have that level of knowledge about wireless networks.

Air Magnet: The Wi-Fi Engineer’s Tool Belt

The second vendor I very much wanted to blog about from Wireless Tech Field Day is Air Magnet. As I gained more knowledge in deploying wireless solutions and progressed beyond simply following the setup instructions my colleagues gave me to implement specific features and functionality I became aware that I needed a larger knowledge base to learn from. My boss at the time recommended using Air Magnet Wi-Fi- Analyzer as it not only was useful in troubleshooting the various problems that came up, but it also had quite detailed explanations and help in its ‘AirWISE’ section of the nature of specific problems it saw and the solutions for those problems. Before I began to study the CWNP program’s materials this gave me some insight and practical knowledge I was lacking. So I have a long history with Air Magnet and although they generously gave me a copy of Air Magnet Spectrum XT at the Field Day it doesn’t change my opinion of their products. I should point out that there was no expectation implied or otherwise in their giving me the XT that I would blog about it or even do anything with it than enjoy it for my own use.

So what is the basic parts of a WLAN professional’s ‘tool belt’? I would say there is several parts to answer that question. The very first thing you are asked to do is to design or plan the WLAN you are going to deploy. In much the same way a builder needs plans to build a house, the basic plan that is needed to deploy a WLAN is the site survey. As 802.11 operates in a part of the radio spectrum that is shared by not only many other types of radio equipment but also other WLAN equipment then you need to have some way, some set of tools, to both see what the spectrum usage currently is and to make a plan to deploy your access points so they will function correctly. You also need to be able to verify after the deployment that things are working correctly and as the RF environment can dynamically change from day to day and hour to hour, you need also a way of troubleshooting both at a spectrum level and at the level of the 802.11 protocol itself what is going on.

Air Magnet’s singular focus has been to make a set of tools that cover all of the above needs for the WLAN professional. Bruce Hubbert, Principal Systems Engineer, covered the first part with Air Magnet Survey at Wireless Tech Field Day. I have been using this tool for several years and still was amazed to see it had functions and features that I didn’t know where there that came up as part of the presentation. Survey gives you the ability to both plan and to verify after the deployment what the WLAN signal will look like. There are often ‘free’ wireless vendor tools for planning that are offered as a part of the purchase of their access points. Almost every one of these I have looked at suffers from the same problem, you will see almost immediately that the APs placed have ‘circles’ of signal surrounding them as if there is nothing blocking or altering their path. This is in almost every case simply not how the signal strength will look once you deploy it and gives you a false sense of how much coverage you can get from the APs. At the very least your users will alter the signal! My opinion of the free tools is you get what you pay for and to me they are pretty much useless for planning purposes. Survey was recently updated to include the ability to use multiple adapters during a survey. Up to two WLAN cards plus a Spectrum Analysis card like the Spectrum XT. This means that you can choose to do, for example, both a passive and active (associated to the WLAN) survey at the same time which gives you a great deal of insight into verifying your deployment.

Air Magnet’s Wi-Fi Analyzer was next up. It also has added the ability to support up to three cards. I mainly use this program for troubleshooting when a currently deployed WLAN is not functioning properly. It has an overall ‘dashboard’ to give you an overview of the current state of the WLAN and then several screens for looking at the list of APs seem and what their signal strength is. I mainly use this to get a good overview of how busy the environment is in the area. I’m sure many of you will be familiar with this basic functionality from tools such as Netstumbler which give similar information, but Wi-Fi Analyzer goes to a much deeper level. It has several other screens so you can focus down on an individual channel, what the RF interference is like, how busy the channel is and much more. My favorite piece however, is the expert analysis given by ‘AirWISE’ which gives explanations of problems seen in the WLAN and suggestions for resolving them. Wi-Fi Analyzer, true to its name, gives you analysis all the way down to the packet level in that you can see the packets as the flow across the network and capture them to save to examine more closely later. Honestly there are too many pieces to this program to tell you about in one blog post but I would sum it up as being as simple or as complicated as you need to troubleshoot your WLAN.

Being able to troubleshoot the WLAN at a packet level isn’t enough, unfortunately. Network engineers almost never these days have to routinely run tests on cables, the physical layer, in order to get the network up. As wireless professionals we need this because of the many other devices sharing the physical spectrum we use. Air Magnet’s Spectrum XT fills this need and very capably. Before this card was released Air Magnet sold a spectrum analysis card made by Cognio which they rebranded. They had some ideas for further extending the capabilities of this product and when Cisco acquired them approached them with their ideas. Cisco, unfortunately was not receptive to this as they were focused on using the Cognio technology in their CleanAir access points. This lead to the development of the Spectrum XT. Spectrum XT is a young product as yet and so has the basic feature set. It has the ability to produce the functions that you would want to see at this level in that it will show you the Real Time FFT charts, Spectrogram and Spectrum Density charts. It can also use a WLAN adapter to provide the 802.11 information on what the signal from access points looks like as well.

The last need is constant monitoring and for this Air Magnet Enterprise is the tool for this. Jesse Frankel presented the Enterprise product to Wireless Tech Field Day and went over in detail what it is capable of. For me, this is a product that I have been aware of but for some reason just not sat down and taken a good look at it. I did see, however, that Air Magnet is continuing to innovate by adding features such as dynamic signature updates to the product. The basic operation of AM Enterprise is that you distribute an overlay of sensors (specialized access points for monitoring) in your network in addition to your APs. These sensors send back information to the AM Enterprise server which collects and does all the heavy lifting of examining the information. I have encouraged people for some time to implement for both security and monitoring purposes on their network some kind of overlay monitoring type system such as this. To me, at an enterprise level you ask yourself first ‘how do I get users access to wireless’ and deploy your APs. Next you want to keep it running so they don’t complain and for this you need some kind of monitoring system. This is where I think the value of AM Enterprise comes in, it not only gives you proactive security monitoring but also enables spectrum analysis and dynamic updates.

A good WLAN engineer always has several tools in his ‘belt’ to deal with various problems that crop up in planning, designing, building and troubleshooting WLANs. Air Magnet, which is now part of Fluke Networks, excels at producing tools that are able to make sense of some quite thorny problems in the daily life of the WLAN engineer. They have been at this for several years now and are regarded by almost every wireless professional I know as being high quality tools made with an in depth knowledge of how RF and 802.11 works yet bringing that depth of knowledge to us all in an accessible way. I made the decision several years ago when researching a standard set of tools for the WLAN engineers at my company to use Air Magnet Survey for on site verification and surveys, Air Magnet Wi-Fi Analyzer for troubleshooting and Air Magnet Spectrum XT for Spectrum Analysis. I highly recommend any one of these for use in these tasks at your place of business.

I was not very aware before this trip of the effect that their acquisition by Fluke would have on Air Magnet, but now that I have seen that this in reality is a melding of two companies with a very similar vision, one in the wired sphere and one in the wireless, I am all for it. The vision of using Fluke’s Air Check tool for junior network or desktop troubleshooting folks and letting the above tools become the professional set of tools makes total sense to me. I actually wanted an Air Check for myself, (but it was not to be) as I saw immediately how useful it could be in many situations. Adding to this Air Magnet Enterprise gives the network admin visibility and monitoring over the entire WLAN with dynamic security updates. This hits every level for the WLAN professional and is a powerful set of tools to make sure your WLAN is functioning like a well built house.

Cisco’s CleanAir vs the Atheros vendors

Last week I attended Wireless Tech Field Day in San Jose. It had a heavy emphasis on spectrum analysis in that three of the vendors (Cisco, Metageek and Air Magnet) spoke about their SpecAn products. As I am currently studying for the CWAP exam I was particularly interesting in learning more about Cisco’s CleanAir product as I had not yet had a chance to see up close these APs and to hear about their features. My initial thoughts about Cisco’s presentation on in general for our group was that it with was overly marketing heavy with too many powerpoint slides and marketing misinformation and not enough in depth technical information that the delegates were seeking, I noticed that my other friends who knew more about the Cisco products were sitting largely silent with a glazed look on their faces throughout much of the presentation. They also refrained from bringing out any of the actual products for us to look at closely or providing, as HP did, a free form question and answer session showing a WCS and controller running the CleanAir APs. I believe that Cisco really missed a great opportunity here to show a group of enthusiastic and very technical WLAN professionals how compelling the features of the CleanAir product are at a technical level instead of marketing BS. I went in with an open mind to learn about this technology as I believed (and still do) that it is providing a real benefit to customers.

This blog post is largely the result of an interaction I had towards the end of the session with Jameson Blandford which was made to be off camera. I guess Cisco was concerned that somehow the information he would speak about was somewhat proprietary and they didn’t wish their competitors to know. Fair enough, I thought at first. It didn’t, however, end up being very much about their proprietary tech in CleanAir so much as a bashing session about why Cisco’s products were superior to the Atheros based SpecAn solutions promoted by their main competitor, Aruba. In the end I got sick of this line of attack and spoke up to disagree with the line of reasoning which was essentially that you _had_ to have CleanAir APs because having the SpecAn on the AP that was servicing clients was the only way to do spectrum analysis. I am not usually a person to buy into this kind of ‘my way is the only way to do something’ type reasoning as I know that the reason we have such a wide variety of WLAN vendors in the market in the first place is that different people have different needs and a single vendor just doesn’t have a lock on everyone’s needs in the first place. As an aside I have had disagreements with colleagues who also claim that there is only one _insert vendor name_ way to do things in whatever field they specialize in.

The main argument that was being provided by Cisco against the Atheros based vendors was that their dedicated SaGE chip in the CleanAir APs was able to get a much more detailed view of the wireless interference and differentiate between say bluetooth interference and a microwave oven. This is true. The way Cisco has designed their system in CleanAir enables the AP to not only see the difference but decide on what to do based on what they see. My point to here is that I am not sure this really matters. In the end to a WLAN client, interference is interference and they don’t really care about the source, just that when they see it they have to stop transmitting or receiving until the air is clear. It matters to the AP how long or how persistent the interference is as Cisco has designed their system to use that information to decide if the AP should change channels to get away from the interferer. The same thing can be achieved, however by the Atheros based systems even though they don’t have as detailed visibility into the type of interference in that by overlaying their SpecAn APs dispersed with their normal APs they can get information on how the interference is affecting the clients connecting to those APs. If they are obviously not transmitting or using lower rates to deal with the interference the software can make a decision to change channels. I would also counter this point with Cisco in that if an AP is unable to deal with the interference by changing channels you would still need an engineer to go with a portable SpecAn laptop to figure out what is going on.

I have had many interactions with clients about their WLAN needs. I would say the majority of them and most concerned if the product they are buying meets the needs of their users in providing a good experience when connected to the WLAN (usually they have at least one application driving the business case) and a close second to this is the overall cost of the solution reasonable. Some are willing to pay for additional features they see as necessary, others just want the cheapest thing that will do the job. Some, and I believe this is the minority, will stick with what they know even though its more expensive in the long run as they believe this will make their job easier. Spectrum Analysis is an added feature and when a customer believes this will enable them to provide a better end user experience, they will see it as something worth buying. As most network admins responsible for deploying APs will not have had a heavy exposure to Spectrum Analysis they will either need training to know how to use this feature or they will rely on a WLAN professional to advise them how best to use this information. I am of the opinion that by making this feature a part of the standard WLAN chipset as Atheros has done, this lowers the bar on making this particular feature something that most admins have knowledge of and makes it more accessible. To me, more knowledge and more people having the knowledge of this part of how WLANs work goes a long way towards making it so WLAN’s are not ‘magic’ to network admins. I believe we will one day have it so learning about RF is a standard part of learning about networks because wireless networks will be so ubiquitous that it will be more unusual to have a wired LAN servicing clients than wireless.

My take on the integration of Spectrum Analysis features into access points is that it is a plus in general for improving the ability of the WLAN administrator to see what is going on in his network in much the same way packet analysis helps wired networks. This is really a critical function that didn’t have a lot of visibility before Cisco rolled out this feature set. I applaud Cisco for both bringing this issue to the forefront and for using the high quality SaGE chipset from Cognio to do this.

I am skeptical of Cisco’s marketing strategy for this product, however. They seem to have placed the 3500 series in a position in the market where they are an expensive solution for many businesses that want to gain some spectrum analysis features but don’t have the budget to buy these APs and place them throughout their enterprises. Meraki and Aruba seem to be filling in this gap, with APs that although they may be based on a more generic Atheros chip, are still good enough when integrated with the appropriate software to identify and avoid major non-802.11 interferers. I expect to see Aruba and to a lesser extent Meraki fill this need for a cheaper solution and gain market share from Cisco with a strategy of selling their solution as an always-on overlay in much the same way Aruba sells their current WIPS solution.

I would also contend that Cisco is not replacing the need for a WLAN professional with knowledge of spectrum analysis and a laptop with either Air Magnet or Metageek Wi-Spy to go in and pinpoint what is going on at a deep level in the spectrum at a particular area of a site that is having persistent problems. This will continue to be the case for many years to come as although the CleanAir chips provide ongoing analysis and are powerful, Cisco has really missed the boat in letting their standalone product lag behind other SpecAn vendors in not having a USB form factor. Looking at the vendors producing these type of Spectrum Analysis products while we were at the Wireless Tech Field Day it was very obvious that they were not standing still in adding features and functionality to their products that Cisco had not considered when they acquired Cognio. Cisco has stagnated somewhat in comparison to the above two vendors in SpecAn feature sets.

I would advise any WLAN Professional considering deploying these APs to carefully consider the ROI of the solution compared to the several different overlay options from vendors such as Air Magnet, Motorola AirDefense and now Aruba and Meraki. Sure it means a less integrated strategy than making the whole WLAN Cisco based, but it may just be ‘good enough’ that you can still gain the advantages of having Spectrum Analysis capabilities without the pain in your wallet. Oh and by the way, you’ll still need to tell your boss that you should by that copy of Air Magnet Spectrum XT or Metageek Wi-Spy that you’ve had your eye on for a while now. I would add as well you should go get certified in analysis by taking a course and exam from CWNP as a Certified Wireless Analysis Professional (CWAP).