Filtering Scan Results in WiFi Explorer April 8, 2018
One of the things I didn't spend too much time with at the beginning of the development of WiFi Explorer was filtering. As the tool matured, it was more than evident that some filtering capabilities were needed. Nevertheless, I didn't want to make anything overly complex. Filtering had to be quick and easy to use, and more importantly, the syntax used to create filters needed to be "natural." With these goals in mind, I've been working over the years on different ways to filter scan results in WiFi Explorer and WiFi Explorer Pro.
In WiFi Explorer, filters let you focus on a specific set of results to facilitate monitoring, troubleshooting or analysis. You can quickly filter scan results by network name (SSID), BSSID, channel, signal strength (RSSI), annotations, mode, vendor, device name, band, country code, security or encryption type.
Below you can find a cheat sheet with the most common display filters:
To filter scan results by:
Network name (SSID), annotations, vendor or device name: type the text in the Filter field. If you need to filter using an exact match, use quotation marks for the keywords, e.g. "ABC School".
BSSID: type either :XX or XX: where XX is an octect of the BSSID you are searching for. You can also extend the text with more octets (e.g. XX:XX, XX:XX:XX) to search for more specific BSSIDs.
Signal strength (RSSI): type a comparison operator (<, >, <= or >=) and the signal strength level in the Filter field. For example, to display only the networks that have a signal strength greater or equal than -65 dBm, type >=-65. If you want to use percentage as units when filtering, type >=50%.
Channel number: type the channel number in the Filter field.
Band: type the band (e.g. 2.4 GHz, 2.4ghz, 24ghz, 5GHz) in the Filter field.
Mode: type the letter or letters that identify the mode: a, b, g, n, or ac. You can also prefix the letter(s) with 802.11, 80211 or just 11. For example, type 11g to display only networks that support 802.11b, or ac to display only networks that support 802.11ac.
Security or encryption type: enter the acronym for the security or encryption type in the Filter field. For example, type WPA2 to display only networks that are configured with WPA2.
Filtering using multiple fields
You can filter on multiple fields by separating the keywords using "," (OR) or "&" (AND). For example, if you want to filter networks so that only 2.4 GHz networks with a name (SSID) starting with School are shown, simply enter 24ghz & School in the Filter field. If you want to display only networks on channels 1, 6, or 11, type 1, 6, 11 in the Filter field.
Negating a filter
You can negate a filter by simply prefixing it with "!". For example, to list all networks that do not have the word School in their names, simply enter !School.
You can use pre-defined filter controls to quickly display 2.4 or 5 GHz networks, as well as secure or open networks only.
In WiFi Explorer Pro, you can also create custom filters by clicking the '+' button in the Quick Filter bar or by going to WiFi Explorer Pro > Preferences > Filters. Custom filters are automatically added to the Quick Filter bar and can be selected the same way you select pre-defined filters.
Automatic filter controls
Additional filters are automatically generated based on the scan results. These filters can be chosen from the left side panel by selecting one of the items under each of the following categories: Network Name, Mode, Channel Width, Security, Access Point and Vendor. You can show or hide the side panel by clicking the left icon in the Show/Hide option of the WiFi Explorer Pro toolbar.
Filtering by signal strength using keyboard shortcuts
Another way to filter scan results is by using keyboard shortcuts to filter networks by signal strength. By using a combination of the Option key and one of the keys representing the numbers from 0 to 9, or the keys below (Q, W, E, ..., I, O, P), you can set a desired signal strength threshold in 5 dB increments. If you set a filter using one of these shortcuts, you can clear it by pressing the Escape key.
For example, to display only the networks with signal strength equal or greater than -70 dBm, press Option-7. Similarly, to display only the networks with signal strength equal or greater than -75 dBm, press Option-U (the letter U is located below and between 7 and 8 in the keyboard, therefore it gives you the mid value between -70 and -80 dBm). The same applies if using percentage (%) as units for signal strength: 1 for 10%, Q for 15%, 2 for 20%, etc.
When you filter by signal strength using these keyboard shortcuts, a legend appears at the bottom of the window indicating the signal strength level being used to filter the scan results.
Keeping a simple, "natural" syntax is great for quick and easy filtering, however, it has some drawbacks. For example, not every piece of information can be used for filtering. Also, there are cases where filters will not give you the expected results, not because the implementation is wrong, but because a simpler filter might not be as effective as one that is more elaborated (for example, filtering using the letter 'a' will give you all 802.11a networks, but not the networks containing an 'a' in their name). Nevertheless, I believe the filtering capabilities in WiFi Explorer offer great flexibility and are good enough for your every day use. There is of course room for improvement, and better filters will be added as the need arise.
Using External USB Wi-Fi Adapters with WiFi Explorer Pro January 19, 2018
For many years I've been asked to provide support for external USB Wi-Fi adapters in WiFi Explorer. Many of these adapters are either not compatible with macOS or require the use of proprietary drivers provided by the manufacturer of the wireless chipset. In order to support these adapters in a native way, it is necessary to have access to the driver's source code. Unfortunately, manufacturers have expressed no interest or simply ignored my emails, which for some reason was a common occurrence last year for these and other collaboration attempts (sad face).
But there's a way. The External Adapter Support Environment (EASE) allows WiFi Explorer Pro to use certain external USB adapters for Wi-Fi scanning, as long as these adapters are compatible with Linux and support monitor mode. EASE is basically a lightweight Debian virtual machine (about 1.7 GB on disk, 256 MB RAM) that has been customized to leverage the remote sensor functionality to automatically configure an external adapter as a pseudo-local sensor. These pseudo-local sensors are listed in WiFi Explorer Pro separately from remote sensors, but they work in the same manner: capturing beacons while hopping between all supported channels.
The majority of users have no need to use external adapters, especially because the built-in adapter works great for scanning in active and passive mode. It also works great for packet captures. However, the main advantage for using an external adapter to scan for wireless networks is that you get the benefits of using passive mode without the need of disconnecting from the network. Passive scanning cannot be used while associated to a network because it requires the adapter to be put into monitor mode, but it can find hidden networks and networks that are farther away (see Understanding the Scan Modes in WiFi Explorer Pro). It also provides more consistent scan results than active scanning. If you're using an external adapter via EASE, the built-in adapter can still be used for connectivity.
One of the nice things about EASE is that you need zero knowledge about Linux or how to build or install the different drivers needed to use these external adapters. Creation and provisioning of the virtual machine is completely automatic using a tool called Vagrant, together with VirtualBox.
git clone https://github.com/adriangranados/ease.git
The installation of the environment takes a few minutes as the VM image is downloaded and provisioned. Once done, you will find a new VM in VirtualBox called EASE. At this point, EASE is ready to use and you can proceed to attach your external USB Wi-Fi adapter.
Using VirtualBox's USB Device Filters you can configure the environment so that every time you plug in the adapter to the USB port in your computer, the adapter is automatically connected to the EASE VM:
1. Plug in the adapter to any of the USB ports in your Mac.
2. Open VirtualBox and select the EASE VM.
3. Choose Settings > Ports > USB.
4. Add a USB filter by clicking the icon with the + sign and choosing the adapter you just plugged in.
5. Click OK, then unplug and plug back in the adapter.
If the adapter is recognized as a supported Wi-Fi adapter, it will be listed under the Scan Mode menu in the WiFi Explorer Pro's toolbar and you can choose the adapter for scanning.
The WiFi Explorer Pro integration with EASE is just the first step. It demonstrates the concept while extending WiFi Explorer Pro's functionality with the use of external adapters. My plan is to use EASE for truly simultaneous packet captures on multiple channels, which can be useful for troubleshooting roaming and other aspects of the Wi-Fi environment. I also plan to develop a solution to automatically attach the adapters to the EASE VM, as well as to manage EASE from the menu bar, thus eliminating the need to invoke Vagrant via its command line tool.