Capture beacons in PCAP or CSV format
Save beacons in PCAP or CSV format using on-screen Scanner app
Previous7️⃣ Bonus Capture Wi-Fi 7 Management FramesNextBonus: Capture using WLAN Pi and iPhone or iPad
Last updated
Save beacons in PCAP or CSV format using on-screen Scanner app
Last updated
On-screen Scanner app now supports 2 new output formats. It allows you to easily start and stop packet capture and save all beacon frames in PCAP (Packet Capture) format, or export them in CSV (Comma-Separated Values) format fully compatible with Apple Airport Utility. The one you know from iPhone and iPad.
Check RSSI levels
Detect rogue access points
Verify SSID presence on the air (ideally every 100 ms or so)
Detecting missing beacon frames (usually a warning sign of bigger issues)
Verifying capabilities announced by access points in the beacon frames
Here is an example of the Scanner application in use to survey a busy shopping mall, quickly and easily building a list of all the broadcasting Access Points (and learning just how much tenant Wi-Fi is out there). As you can see, it is easily held in one hand and does not need to attract any attention.
Open the on-screen menu of the WLAN Pi and navigate to Apps > Scanner > Scan to CSV. After you have entered the Scan to CSV tool, it will automatically start scanning for all existing Wi-Fi networks.
Scanner updates every 1 second, and will show the latest results on the screen while saving them to in Apple Airport Utility CSV format. You can then find them in this location /home/wlanpi/scanfiles on the micro SD card where the file name includes the date and time the scan was started.
Leave the Scanner screen on for as long as you need to capture. It's a good idea to page up/down every few minutes to prevent the screen sleeping and missing scans.
When you are ready exit this screen by moving joystick towards the left. The scan has now finished. Let's verify if it has been saved.
Using Terminal, run cd /home/wlanpi/scanfiles followed by ls command. The file has been successfully created on the WLAN Pi with a timestamp. Standby, we will copy this file to our laptop later and open it in WiFi Explorer Pro for further analysis.\
Let's repeat the same exercise. This time we will save all beacon frames from the air to a PCAP file.
Use your joystick skills to navigate to Apps > Scanner > Scan to PCAP > Start.\
Scanner is now saving all seen beacon frames in PCAP format. Why does PCAP format excel over CSV, what do you think?
We have now captured enough beacons. Move joystick to the left to exit the current screen. Then and press Stop.\
In Terminal, run cd /home/wlanpi/scanfiles just to make sure we are in the right directory. This time use ls -l and check file sizes (16643 bytes and 63953 bytes). The PCAP file is larger. Is that expected? Why?\
Peek inside the CSV file by cat <file-name> | more command if you are interested. Quite simplistic plain text format which contains SSID, BSSID, RSSI, Channel and Time.\
In web browser on your laptop, open the WLAN Pi Web UI by navigating to https://wlanpi-xxx.local/
Click COCKPIT.
Log in using wlanpi username and your password.
In Cockpit, click Navigator in the left menu. A file explorer opens and you can easily upload and download files and folders to and from the WLAN Pi. Useful tool for sure. \
Double-click home > double-click wlanpi. The scanfiles directory will appear on the screen.
a. Right-click on the scanfiles directory and Download the whole folder to your laptop.
Unzip the downloaded archive and navigate to the files.
Open WiFi Explorer Pro on Windows or Mac. Drag and drop the CSV file to WiFi Explorer Pro window. Don't save any scan results when the dialog opens. The CSV file magically opens.
Open Advanced Details and there are no details. Why?
Drag and drop the PCAP file to WiFi Explorer Pro window. Don't save any scan results when the dialog opens. Check the scan results from PCAP file. Open Advanced Details and you get what you captured. That's right packet capture format includes the actual full beacon frames and we can easily analyse them this way post site visit.
Open the downloaded PCAP file in Wireshark. We think this feels familiar to you, right? We see beacon frames including all detail. If you need to understand the exact time between 2 beacons of the same AP, that's easy-peasy.
Compare this to the CSV format, which is lightweight, but quite likely too simple for the job.
