Wi-Fi Communication Network Evaluation and Analysis Methods - No need for expensive specialized equipment! High-precision Air Log Analysis Guide using a MacBook and Wireshark - | NEXTY Electronics, an electronic components and semiconductor trading company

Are you struggling with expensive dedicated sniffer equipment and complex settings when troubleshooting Wi-Fi communication problems? To resolve on-site issues like unstable connections or slow speeds on specific devices, analyzing "Air Logs" (air packets) is essential, which visualize the invisible radio wave conditions. While expensive dedicated equipment is usually required, anyone can create an advanced analysis environment that supports the latest standards like 11ax by combining a MacBook with Wireshark.

This article provides detailed instructions on how to start professional Wi-Fi analysis at minimal cost, as well as how to use FILTERS and statistical information to achieve efficient debugging.

Background: Why choose MacBook + Wireshark?

When analyzing or evaluating Wi-Fi, it is common to use dedicated "Wi-Fi sniffer" equipment. However, commercially available dedicated equipment has high installation costs, and in many cases, ongoing license fees are also incurred.

One of the first challenges you'll face in actual analysis is whether you can capture raw wireless FRAMES in monitor mode (sniffer). Whether this is possible is not determined solely by the performance of the wireless chip, but also heavily depends on the OS driver model and the vendor's support policy. In Windows environments in particular, there are many configurations where monitor mode is not officially provided, which can make launching analysis work a hassle.

On the other hand, macOS has a mechanism in place that anticipates wireless analysis applications to a certain extent, and depending on the conditions, it is easy to start sniffer operation using the OS's standard functions. Furthermore, MacBooks tend to use chips that are early compatible with the latest Wi-Fi standards, so another practical advantage is that you can start analysis in a new standard environment without waiting for a hardware update for dedicated equipment.

Of course, specialized equipment is essential in situations where official warranties or manufacturer support are required. However, for early development stages or rapid on-site troubleshooting, an analysis method combining a MacBook and Wireshark is a realistic and effective option. In this technical column, we will explain how to perform efficient Wi-Fi analysis using this configuration.

Preparation: Equipment used and basic analysis concepts

The environment required for analysis is as follows:

Equipment used: MacBook
Software used: Wireshark

The most important thing about Wi-Fi analysis (Airlog analysis) is to understand that it is an "open environment capture." Not only the target communication, but also packets from countless surrounding Access points and other devices are captured. The success of the analysis depends on how efficiently you can extract only the "target communication" from this vast amount of noise and create an environment that is easy to analyze.

Practice 1: "FILTERS Techniques" to Extract the Truth from Massive Data

By making full use of FILTERS field at the top of the Wireshark screen, you can display only specific packets.

Practice 1.1 FILTERS by packet type (Type/Subtype)

Wi-Fi communication consists of packets with various roles, such as association requests, beacons, and acknowledgements. These can FILTERS using the following format:

Below is the Wireshark screen: Set FILTERS on the red line.

Basic format: wlan.fc.type_subtype == [packet number]
Examples of major packet values:
◦ 0x0000: Association Request
◦ 0x0001: Association Response
◦ 0x0008: Beacon (notifying the presence of a base station)
◦ 0x001d: Ack (acknowledgement)
◦ 0x001c: CTS (Send permission)
◦ 0x0028: QoS Data

In addition, multiple packets can be extracted simultaneously by using logical operators (||: OR, &&: AND).

Example: To display both Association Request and Response, use wlan.fc.type_subtype == 0x0000 || wlan.fc.type_subtype == 0x0001

Practice 1.2 FILTERS by MAC address

To narrow down the search to communications for a specific device (DUT: Device Under Test), use the following format:

Transmitter address (ta): wlan.ta == [MAC address]
Receiver address (ra): wlan.ra == [MAC address]

Click on the relevant packet in Wireshark and enter the MAC address listed in "Transmitter address" in the "IEEE 802.11 Association Response, Flags" section in the format above.

Wireshark has a function that automatically detects the manufacturer code of the MAC address and converts it to something like "Apple_b8:89:37" and displays it, making it easy to identify the device.

Practice 1.3 Complex Compound FILTERS Example

The following is a practical FILTERS formula that extracts all communications between the iPhone and the device under test (DUT), including Beacon, Ack, and CTS.

(wlan.ta == [iPhone's MAC] && wlan.ra == [DUT's MAC]) ||
(wlan.ra == [iPhone's MAC] && wlan.ta == [DUT's MAC]) ||
(wlan.ta == [DUT MAC] && wlan.fc.type_subtype == 0x0008) ||
((wlan.fc.type_subtype == 0x001d || wlan.fc.type_subtype == 0x001c) &&
(wlan.ra == [iPhone MAC] || wlan.ra == [DUT MAC]))

Practice 2: Setting "coloring rules" to dramatically improve visibility

With a lot of text flowing through your screen, you run the risk of missing important events. Use Wireshark's "coloring rules" feature to your advantage.

1. Click "View" → "Coloring Rules".

2. Click the "+" button to add a new rule and enter a name (e.g., Retry, Beacon, etc.).

3. Enter the above format (e.g. wlan.fc.type_subtype == 0x0008) in the "FILTERS" field.

4. By selecting "Background Color", the corresponding packets will be highlighted in the specified color.

This makes it possible to visually and instantly identify abnormalities, such as by displaying retry packets in red.

Practice 3: Predicting behavior and identifying causes using statistical information (input/output graphs)

Before tracking individual packets, it is important to first get an overview of the overall trend. Use the "Statistics" function.

1. Select "Input/Output Graph" from the "Statistics" menu.

2. Add a new item with the "+" button.

3. Enter any name in "Graph Name" and the MAC address and packet type to be analyzed in "Display Filter".

4. Check "Enabled" to graph the number of packets over time.

[Key points for analysis: What should you pay attention to?] Identify the point on the graph where the number of packets suddenly stops or shows an abnormal drop. Analyze the packets in that area in detail and focus on the following behavior to deduce the cause of the problem.

Retry flag: Are retransmissions occurring frequently?
Number of beacons: Is there a sudden drop in signal from the base station?
RTS/CTS and Null Packets: Where Does Control of Communication Stop?

Summary: 3 Steps for Efficient Wi-Fi Debugging

The efficient analysis flow using this method is as follows:

1. Extraction: Utilizing complex FILTERS formulas, we eliminate noise and extract only the necessary communications.

2. Visualization: Apply coloring rules to visually identify retransmissions and connection errors.

3. Inference: Identify the point of communication interruption from the statistical graph, and narrow down which device is causing the problem based on packet-level behavior (number of beacons, retry flags, etc.).

You can dramatically improve the accuracy of your Wi-Fi analysis by simply using your MacBook and Wireshark, without relying on specialized equipment.

As an action to take after Wi-Fi analysis, once it has been determined that the problem is caused by the wireless section, the next step is to incorporate it into the design elements.

For example, if there are a lot of retransmissions, then receiver sensitivity and ANTENNAS placement are important issues; if congestion is suspected, then channel design and band selection are important issues; if roaming is causing problems, then AP settings and client roaming behavior are important issues. When selecting a chip/module, not only the target standard but also the log acquisition and ease of debugging required at the evaluation stage will have an impact on "development costs."