SigSpy

back to http://scratchpad.wikia.com/wiki/Sasecurity TableOfContents

Sigspy results
I having problems with one of my devices. Most MeshAP being either Via board or Compaq have gone up with relative ease and did not required performance tuning other than boosting the power of the radio card; however, I have one device that seems to have very poor performance. When I install a MeshAP it is either a PC using LMR-400 and a 8 dbi antenna or a Out Door Unit (ODU)using a VIA board and a pigtail and 8 dbi antenna. The device I having problem with is a Compaq that is showing a 1 Mbps connection speed. In my lab it shows 11 Mbps. After installation I plug the unit in and turn it on. Basically walk away. Then I go to Wiana to verify that it is connected. 100% of the time it indicates that it has connected. I then ensure that all the Wiana setting such as Antenna etc are set correctly. After that I ssh into the box and run the following commands

* "reporter" * "sigspy"

I know also add the following command: * For Radio Cards that are 200 mW: "ifconfig wlan0 txpower 200mw" * For Radio Cards that are 50 mW: "ifconfig wlan0 txpower 50mw" * I than check Wiana after about 15 minutes to see reporting in Wiana.

I have noticed that that I am getting a lot of Radio Reflection from my other MeshAP's that are not in direct line of site. They have a physical barrier - FarradayCage - between the two radio cards that are reflecting and a direct line of site to the uplink node. What is happening is that message indicates it has found a new gateway. It then bounces back and forth between different routes to the gateway.

My solution was to increase the power in the card and to add another MeshAP to give it a solid link to the gateway. This provide a good solution for about 12 hours and now it has reverted back to looking for new gateways.

I don't want to lock it to a single gateway as my intension is to put many gateways up.

I tried to "blocknode" the two problem MeshAP that are reflecting however this command did not do anything

Sorry for the long winded build up but the question is there an alternative to stop receiving reflect RF from a known Meshap? > Let me share some information that may help this discussion. > > The signal levels in wiana are wrong. Not inaccurate, just not true -dB > levels. RF is rated in decibels. Since the RF we are working > with is such > low power our output is in the -50 to -89 range. Depending on your > card, -89 to -96 is the cut off point where your card becomes > "deaf". The > levels in sigspy are roughly 1/3 of the true reading. Do test > this, look > at a link in sigspy then look at the link levels reported in > wiana under the > neighbors link (click on the interlocking rings symbol). You > will notice > drastically different readings. Trust the ones in wiana, we have > found them > to be fairly accurate. > > Analysis of your link below: > > Signal level:-34 dBm Noise level:-38 dB > -This puts the link at near unusable. The link is probably reporting in > wiana is probably -87 to -89. This drops it into the 1MB > category with lots > of packet loss. Under heavy traffic this link will likely fail. > > Quality:232/92 > -This shows a bad link quality. If the number reached 255 the > node will be > blocked by its partner. > > I hope this helps.

> > Strange, because the 3rd one (which is now '00:xx:xx : Quality:232/92 > > Signal level:-34 dBm Noise level:-38 dB > > m (updated)') is another node across the road. According to > Wiana I have a > > 95% signal between the two. > > > > I'm getting pretty fed up there is no "idiots guide" to understand the > > very > > basics of the information provided that you expect to run a cutting edge > > business off. > > > > How about a "This is the commands you can use .. Getandverify .. > > Factoryreset .. Etc" on the wiki. I'll start it myself if you want. > > > > Nick > > www.meshuk.com > > > > P.s. I have altered some senstivity settings, and gone from > clean to noisy > > and vice versa. But I really don't know what that really means.

> > General rule of thumb, look for 9db separation. The value does > not matter, > > only the difference between the two. > > > > So on your example - level:-25 dBm Noise level:-38 dB - good > signal - the > > rest I would regard as unworkable.

> > Just wondering whether I'm getting good signals. Can anyone give a > > definitive description on what the figures mean? I've searched my past > > emails and can't find this info, same with the wiki. > > > > A past question by David Crane wasn't answered as far as I can see .. > > > > " > > wlan0 Statistics collected: > > > > 00:02:6F:09:A4:0B : Quality:7/92 Signal level:-20 dBm Noise level:-37 > > dBm > > (updated) > > > > 00:02:6F:09:A4:0C : Quality:6/92 Signal level:-21 dBm Noise level:-37 > > dBm > > (updated) > > > > typical/average : Quality:0 Signal level:0 Noise level:0 > > " > > > > I'm getting this from sigspy .. > > > > " > > Every 2s: iwspy wlan0                                  Sat Oct 23 > > 20:37:13 > > 2004 > > > > wlan0     Statistics collected: > >    00:xx:xx:etc : Quality:227/92  Signal level:-36 dBm  Noise level:-39 > > dB > > m > >    00:xx:xx:etc : Quality:254/92  Signal level:-25 dBm  Noise level:-38 > > dB > > m > >    00:xx:xx:etc : Quality:233/92  Signal level:-34 dBm  Noise level:-39 > > dB > > m (updated) > >    typical/average   : Quality:0  Signal level:0  Noise level:0 > > " > > > > My signal strengths are completely the opposite, so wonder if this in > > fact > > terrible results?

Issues
I'd guess you have something running in peer-to-peer mode in the vicinity of the meshAP. I've seen the all-4's mac in netstumbler under those conditions. Infrastructure This is the only node that is doing this, and it has only just started doing it. Are you in adhoc mode or infrastructure?

Does anyone know what this is:

44:44:44:44:44:44 : Quality:0/92 Signal level:-100 dBm  Noise level:-100 dBm

00:09:5B:91:A5:76 : Quality:0/92 Signal level:-100 dBm  Noise level:-100 dBm

00:09:5B:91:A5:76 is its own MAC address, all the nodes are showing fine, just this in the middle.

adfasf
ssh into the box and try the following. sigspy watch iwspy wlan2   <- this is what sigspy is watch iwspy wlan1 files with interesting info include * cat /var/tmp/work/scano * cat /var/tmp/work/scanap * cat /var/tmp/work/topo

One more question and I am starting my weekend. I was just doing my Friday check, looking through wiana and something struck me. In the window that shows all your neighbors for a node, it gives you all kind of useful information " ssid, address, channel, mode, SIGNAL, and rates" Now wiana is getting this information from my system and I am wondering how I can get this info at the command line. I would love to see signal is -55 between to nodes at the command line. I can use sigspy but some times my gateway has to many MAC address to display them all and I need another way to check connections. The wiana neighbors windows also tells me what hardware and MAC my neighbors are running, how did it get that info???? Just to sum it all up how is wiana getting all this info and can I get it at the command line?