CTS 125: 802.11 Frame Captures on Windows

We take a look at what resources are available to capture frames on Windows OS.

802.11 Frame Captures on Windows

Back in episode 121, we spoke highly of Macbook Pros being perfect tools for wireless frame captures. But not everyone has a Macbook Pro. Even I still have a Windows laptop and need to do frame captures on that every once and a while.

In this episode, we outline some of the resources we use for capturing frames on Windows OS. Both free and paid versions depending on how you’re trying to capture frames and how quickly you’re trying to accomplish the task.

Budgets will vary widely with each resource so check for the most updated pricing online.

Acrylic Wi-Fi Professional

You can try out Acrylic Wi-Fi with a trial version free for 4 days. As of June 2018, a license is $39.95 one time fee (or $19.95 for 1 year). It has a built in 802.11 packet capture tool without requiring additional hardware. But it only captures beacon frames if your Wi-Fi NIC does not support monitor mode.

The NDIS driver must be installed so your built in Wi-Fi NIC can be used in monitor mode.  If you want, you can use an external adapter to perform the capture. Acrylic recommends the following:

By default, it will be channel hopping. So don’t forget to set the channel on which you want to scan. We strongly recommend using a Riverbed AirPcap card if you are going to do anything professional.

Some of the packet capture features include:

  • Display the Packet Tree view including the details of the Radio Tap Header
  • Displays the Hex and Binary view of the packet
  • You can export the frames into a pcap file and analyze them with another tool (Wireshark)
  • Integration with Wireshark
  • 802.11ac not there with AirPcap Nx

Other Features:

  • Wi-Fi Scanner
  • Show Retry Rate when set to monitor mode
  • Displays the SSID detected (including the hidden SSID)
  • Displays some beacon details
  • Script editor built-in
  • Reports
  • Inventory


Microsoft Network Monitor

This tool is free to use with your operating system. You can download the application from Microsoft and check out a full tutorial.
You can find a Video Tutorial easily on YouTube.


  • Free. You just need a Wi-Fi USB adapter
  • It won’t work with all Wi-Fi NIC. We have tried a bunch for you guys.
  • NICs that work:
    • NIC 300
    • D-Link DWA-130
    • D-Link DWA-160
    • Linksys AE2500
  • NICs that don’t work
    • Realtek 8812AU
    • D-Link DWA-182
    • Netgear A6210
    • Edimax EW-7822UAC
  • Uses the NetMon L1 Header and not the Radio Tap header. With some adapters, you won’t have the RSSI right (Example: NIC 300 will always report an RSSI of 30dBm)
  • Capture can be exported in .cap file and analyzed in Wireshark


Airpcap allows you to captures frames in Wireshark.

You can capture with multiple Airpcap adapters on multiple channels at the same time (Roaming analysis). Check out the post from Revolution WiFi.

Metageek Eye P.A.

Metageek offers many tools including a way to capture frames using Eye P.A. Having used this tool in the past it has been very good especially with the visualizations. Capture from Metageek Eye P.A. with other adapters and NDIS drivers.

Adapters supported:

Savvius Omnipeek

Savvius was recently acquired by LiveAction and for good reason. Savvius has a strong frame capture utility called Omnipeek. It does a lot more than capture wireless frames as it can be useful on the wired side of things. But there’s a powerful expert analysis engine and there’s a way to aggregate wireless adapters in the application to capture on multiple channels.

You can find the Savvius Adapter on Amazon.

What tools are you using?

Is there anything missing from this list? Are you using one application more than the other? Let us know in the comments below.

CTS 124: Wireless Session Quick List – Cisco Live Orlando

Clear To Send is headed to Cisco Live Orlando.

Cisco Live Orlando

One of the largest conferences is headed back to the East Coast – in Orlando, Florida. If you know anything about Cisco Live then you know there are a plethora of sessions to select from. But we’re passionate about Wi-Fi which is what we’re going to highlight in a list here.

These session’s we’re interested in attending and the ones you should keep an eye on. Even if you aren’t attending, most of the sessions will be made available weeks after the conference is finished.

#CLUS Giveaway

Participate in our Clear To Send Giveaway. Because François and Rowell are joining together for the first time for CTS episodes, we wanted to give back to our listeners. We’re offering two giveaways, a Ventev Mobile Device Accessory kit ($300 value!) and a Cisco Press book of the winner’s choice.

Here’s how to enter:

  1. Fill out the form below (United States entries only)
  2. For an extra entry, find Rowell or François at CLUS, take a photo with one or both of them, and share it by tagging @cleartosend on Twitter.

Contest is over!

Live Recordings

Come watch François and Rowell do a live recording of a Clear To Send episode. There are a total of three recordings:

  • Monday June 11th @ 1PM– WiFi Analytics with Christian Gauer at the Podcast Domain Booth #1059 in World of Solutions
  • Tuesday June 12th – Cisco Live WiFi Meetup at 6:30pm – RSVP and Location here
  • Wednesday June 13th at 4pm – 5G with Mike Geller at the Podcast Domain Booth #1059 in World of Solutions

Wireless Session Quick List

Monday June 11

Tuesday June 12

Wednesday June 13

Thursday June 14


CTS 123: Design Principles of Stadium Wi-Fi

François Vergès and Chris Reed join forces on Clear To Send to talk about design principles of stadium Wi-Fi. 

Designing Stadium Wi-Fi

What are important considerations when designing Wi-Fi for very high density environment such as stadium? Of course the tools come to mind such as Andrew Von Nagy’s Capacity Planner and Ekahau Site Survey Pro.

In the initial design, there are different types spaces in stadiums to consider such as bowl, concourse, suites, office space, and event space. The details are discussed in the episode.

Fundamentals are always important. But they are often missed in many deployments. Things such as getting the AP as close to the client as possible, minimizing co-channel contention, transmit power, attenuation, etc. Another consideration, but often difficult to plan for in stadiums, are client devices.

An challenging aspect of stadium Wi-Fi design is AP placement. There are different ways to approach this such as overhead, railing, and underseat. Which one is best for the design and what the pros and cons.

Links & Resources

CTS 122: EasyMesh – Interoperability Between Vendors

Wi-Fi Alliance EasyMesh certification is meant to bring interoperability between vendors for mesh networking.

Wi-Fi Alliance EasyMesh

Mesh networking helps bring coverage in homes where one access point can’t quite do it. The Wi-Fi Alliance EasyMesh enables interoperability across access points from different vendors.

The term given to an access point is Multi-AP.

The Multi-AP has two logical entities:

  • One Multi-AP controller
  • One or ore Multi-AP agents

The Multi-AP agents report measurements and capability data to the Multi-AP controller. A controller interface is defined between the Multi-AP agents and the controller and/or between agents.

Having a controller in the home is an interesting idea coming from the enterprise space. Essentially, this would be located in the residential gateway. The controller will manage roaming and load balancing between APs.

The method in which Multi-APs join the controller will be a mandatory method of Push Button Configuration (PBC). There is also a backhaul station on-boarding procedure via AP-Autoconfig for discovery.

Network Operations

There are various configurations managed from the Multi-AP Controller:

Capability Report

Multi-AP Agents report capabilities to the controller such as the number of radios, channel width supported, PHY protocol supported. 

Channel Selection

Channel configuration is performed by the controller. By default the maximum Tx Power is used but the controller can decide to lower it down to improve system signal conditions. The controller sends a Channel Preference Query message to each Agent. The EasyMesh specification does state DFS support so we’ll see many more channels available in the home.

Link Metric Collection

Client devices can convey link metric information related to the network. Agents also leverage 802.11k beacon report measurements to report metrics about the quality of the links between the agent and the clients.

Client Steering

The controller sends control messages to the agents to steer clients. Client supporting 802.11v BSS Transition Management will experience faster transitions.

Optimizing Connection Between Agents

Controller select the best path to connect the agents together.


It will be interesting to see if vendors will get together on this specification to improve home networking. Wi-Fi Alliance EasyMesh looks aimed for ISPs to provide home mesh networking for their customers. With a gateway from an ISP, they can control the other APs in the home. This helps them reduce the number of customer calls about poor Wi-Fi and reduces the number of truck rolls. We can see ISPs partnering with specific AP vendors which are EasyMesh certified to sell a solution to the customer.

But without more spectrum (6 GHz) and 802.11ax, we won’t see much improvement in home mesh network in environments where it is highly dense.

Links and Resources

CTS 121: Capturing Wireless Frames with a Mac

Capturing wireless frames is a must know skill for any Wi-Fi network engineer.

Capturing Wireless Frames with a Mac

The Macbook Pro is an excellent tool for capturing wireless frames. The built-in wireless adapter can be used to sniff wireless frames in the air. As I like to say, the best troubleshooting tool you can have is the one that’s with you. Since I have my Mac with me all the time I tend to capture frames wherever I go.

There are many pros with capturing frames. It’s a great way to learn how Wi-Fi works. This is how I got started. Understanding how Wi-Fi communication works through frame captures gives you an upper-hand. One example is learning about the 802.11 State Machine.

When it comes to troubleshooting complicated issues, frames don’t lie. Not too long ago, my laptop had a difficult time connecting to public Wi-Fi. It frustrated me so much I decided to capture some frames. Within minutes I found out why. Just take a look at the screenshot below.

Frame capture of an association response


How To Capture Frames

  1. Install Wireshark
  2. Install the Metageek Profile
    1. Unzip the file
    2. Copy directory to /Users/user/.config/wireshark/profiles/
    3. Enable the profile in Wireshark by clicking on the bottom right of the open application. See screenshot below.
  3. Install Airtool
  4. Select channel & channel width to capture on
    1. Capturing frames with Airtool
  5. Start the capture and stop after a short time
  6. Analyze with Wireshark or Mojo Packets

Links and Resources