CTS 121: Capturing Wireless Frames with a Mac

Capturing wireless frames is a must know skill for any Wi-Fi network engineer.
Capturing Wireless Frames with a Mac
The Macbook Pro is an excellent tool for capturing wireless frames. The built-in wireless adapter can be used to sniff wireless frames in the air. As I like to say, the best troubleshooting tool you can have is the one that’s with you. Since I have my Mac with me all the time I tend to capture frames wherever I go.
There are many pros with capturing frames. It’s a great way to learn how Wi-Fi works. This is how I got started. Understanding how Wi-Fi communication works through frame captures gives you an upper-hand. One example is learning about the 802.11 State Machine.
When it comes to troubleshooting complicated issues, frames don’t lie. Not too long ago, my laptop had a difficult time connecting to public Wi-Fi. It frustrated me so much I decided to capture some frames. Within minutes I found out why. Just take a look at the screenshot below.

Tools

* Macbook Pro
* Airtool
* Metageek Profile
* Metageek Profile for Wireshark
* Mojo Packets

How To Capture Frames

* Install Wireshark
* Install the Metageek Profile

* Unzip the file
* Copy directory to /Users/user/.config/wireshark/profiles/
* Enable the profile in Wireshark by clicking on the bottom right of the open application. See screenshot below.
*


* Install Airtool
* Select channel & channel width to capture on

*


* Start the capture and stop after a short time

*


* Analyze with Wireshark or Mojo Packets

Links and Resources

* Airtool
* Wireshark
* Mojo Packets
* Metageek Wireshark Profile
* Automating Wi-Fi Packet Analysis with Pyshark