Introduction
| AirMagnet Spectrum Analyzer | |
|---|---|
| Summary | CardBus card and software that turns XP notebook or tablet into multi-band spectrum analyzer covering 2.4, 4.9 and 5 GHz bands |
| Update | None |
| Pros | • Simultaneous spectrum analysis of 802.11a/b/g bands • Good detection range • Multiple simultaneous displays |
| Cons | • Can’t use Device Finder for 802.11 devices • Somewhat unintuitive UI • Pricey |
AirMagnet has an impressive portfolio of wireless LAN security and management products, and it has continued to be one of the leading companies in this space by expanding that portfolio. The latest addition – AirMagnet Spectrum Analyzer (ASA) – is a welcome addition because it fills the RF (Radio Frequency) analysis capability gap that AirMagnet has had.
RF analysis is important because packet-level products like AirMagnet’s Enterprise, and Laptop and Handheld Analyzer products [reviewed here] rely on being able to receive and decode WLAN signals. But sometimes the problem in a wireless LAN is caused by RF interference sources that don’t emit valid 802.11a/b/g signals. Microwave ovens, cordless phones and Bluetooth devices are the most prevalent sources of RF interference, although by no means the only ones.
What it is
ASA is essentially a repacked / rebranded version of Cognio’s ISMS Mobile 1.0 product, which provides the core technology. The family jewels come in the form of a CardBus card (AirMagnet calls it the Spectrum PC card) that contains the hardware guts of a miniature spectrum analyzer that covers the 2.4 and 5GHz 802.11a/b/g spectra, as well as the 4.94 – 4.99 GHz U.S. Public Safety Band.
Figure 1: The little wonder itself
Here’s what’s inside the card (from the ASA User Guide):
- Radio – The radio transceiver detects the RF spectrum and feeds this data to Spectrum Analysis Engine, SAgE
- SAgE – Spectrum Analysis Engine performs a Fast Fourier Transform (FFT) of the RF spectrum, and provides the feed of low-level data concerning the behavior of the RF spectrum. Low-level data includes basic information on the power vs. frequency in the spectrum at a given instant, and information on individual pulses in the RF spectrum. SAgE also performs on-board statistical analysis of the spectrum, and statistical analysis of RF pulses (which relieves CPUs of this processor intensive task)
- MCU – A programmable MicroController Unit (MCU), running proprietary software, provides low-level analysis of the data stream. The analysis engines include:
- Measurement Engine – Aggregates SAgE data, and normalizes it into meaningful units.
- Classification Engine – Identifies specific types of interferers (Bluetooth devices, microwave ovens, cordless phones and headsets, radar, etc.).
The card represents some pretty impressive engineering, especially considering that the ASA’s closest competitor – Berkeley Varitronics Systems (BVS) Bumblebee – requires a PocketPC-sized “sled” to hold its RF circuitry. Specs (Figure 2)are pretty impressive too, most notably a noise level of only -124dBm and amplitude accuracy of +/- 2.5dBm.
Figure 2: Spectrum Analyzer Specs
The card can be used with any notebook or tablet PC running Windows XP SP1 or SP2 that has a Type II CardBus slot. Note that the card cannot function as an 802.11a/b/g WLAN card, so can neither be used to connect to a wireless LAN nor run any of the other AirMagnet products. Note also that if the notebook or tablet that you run the ASA on has built-in Wi-Fi, you’ll need to turn it off – for obvious reasons!
The card has an MMCX style connector – same as used on the old ORiNOCO and many current Buffalo Technology WLAN cards – for external antenna attachment. AirMagnet also includes a simple 2dBi dipole with short cable and clip for mounting the antenna on a notebook display.
Features
The ASA install onto my WinXP SP2 notebook was uneventful, and while there’s not a “wizard” to guide you through initial setup, it doesn’t take long to get oriented and start playing around. When you first start the program after installation, it goes through an initialization process, then displays a Channel Summary (Figure 3) that shows RF actitivity detected in any of the ASA’s currently-monitored bands.
Figure 3: Channel Summary
(click image to enlarge)
You can customize the monitored bands by using the Monitored Bands settings (Figure 4), selecting from pre-defined bands or even setting up two “User Defined” bands of your own. Note that the “User Defined” band controls don’t restrict you to valid setting ranges, and if you enter “illegal” values there’s no warning thrown and you won’t get the frequencies you set.
Figure 4: Monitored Bands
Clicking on the Spectrum button in the left-hand margin gives you your first look at a spectrum analysis display, which defaults to the Real Time FFT display, monitoring from 2.4 to 2.5GHz (802.11b/g) with all three Max, Max Hold and Average traces enabled. Figure 5 is a snapshot of my idle access point on Channel 6, which, of course, is sending out beacons. I liked the markers for non-overlapping channels 1, 6 and 11, but they can be turned off in case you prefer your spectrum view unadorned.
Figure 5: Default spectrum analyzer view
(click image to enlarge)
You can choose from twelve different plots in the Spectrum Analyzer, which are generated from various slicing and dicing of the thousands of FFTs performed each second. (An FFT is a mathematical calculation that takes analog-to-digital data of a waveform sampled at regular time intervals and converts it to a view of the amplitudes of the discrete frequencies that make up the waveform.) I’ll be delving further in the Spectrum feature in the next section.
The third and fourth ASA functions are the Interferers display shown at the bottom of each screen and the Device Finder. ASA considers non-802.11 RF devices broadcasting in the same frequency bands as 802.11 devices to be Interferers. It automatically identifies Interferers without user intervention by analyzing various aspects of the captured spectra and logging them to the Interferers display. ASA can identify Bluetooth devices, microwave ovens, cordless phones and base stations, cordless headphones, wireless video extenders as well as continuous signal sources.
The Device Finder is basically an interactive signal strength / history display that you’d use to track down the physical location of an Interferer.
Figure 6: Device Finder
(click image to enlarge)
Figure 6 is taken from the ASA User Guide because my RF environment is pretty clean and the Device Finder can be used to find only active Interferers. I asked both AirMagnet and Cognio why the Device Finder couldn’t be used to track down 802.11-based sources – which as we all know can also be sources of interference.
The answer both companies gave boiled down to not wanting ASA to overlap functions available in AirMagnet’s other products, which handle device management and troubleshooting for devices emitting real 802.11 signals. I also got the sense, however, that since ASA is a 1.0 product, AirMagnet will be listening to customer feedback and possibly change their stance on this feature lockout.
In Use
As I mentioned earlier, the Spectrum function features twelve different plots. Four of these – Real Time FFT, FFT Duty Cycle, Swept Spectrogram, and Power vs. Time – are fundamentally different views, one – Power vs. Frequency – is a “tweakable” form of the Real Time FFT, and seven are “Air Quality” plots for advanced RF analysis.
The two plots that I found myself using most of the time were the Real Time FFT and Swept Spectrogram demonstrated in Figure 7. The nice, regular spectrum shown was generated by running IxChariot‘s throughput script continuously between a single wireless client and AP simultaneously in uplink and downlink directions.
Figure 7: Nothin’ but Channel 6
(click image to enlarge)
The Real Time FFT and Power vs. Frequency plots are ASA’s two forms of implementing basic spectrum analysis. The main differences between the two are:
- the Real Time FFT has a fixed resolution bandwidth (RBW) of 156 KHz while the Power vs. Frequency’s RBW can be set from a minimum of 9.77 KHz to a maximum of 1.25 MHz
- the Real Time FFT plot is generated every second from 5000 FFTs that are crunched by the SAgE engine in the Spectrum PC card while the Power vs. Frequency plot represents one FFT per second calculated in the Spectrum PC card’s MCU
In simple terms, this means that you choose the Real Time FFT if you’re looking for short-lived, but relatively broadband RF phenomena and the Power vs. Frequency plot if hunting for repetitive narrowband glitches. It took me awhile to figure out to use the Average mode for the Power vs. Frequency plot to get anything resembling what I was seeing with the Real Time FFT for my nice, steady WLAN activity.
At first, I thought the Swept Spectrogram plot was mostly eye-candy, but found that it can be a good way to detect changes in relatively quiet RF environments. Figure 8 shows what happens when I moved the notebook containing ASA near my microwave oven that I then turned on.
You can tell that something is going on by comparing the Real Time FFT portions of Figures 7 and 8. But by looking at the Swept Spectrogram – which is showing about 5 minutes worth of history – you can see that the microwave signal is both “bursty” and pretty much covers the entire 802.11b/g spectrum. You can also see that peak microwave signal strength falls between Channels 6 and 11 (the red areas in the Swept Spectrogram).
Figure 8: Channel 6 plus microwave oven
(click image to enlarge)
In Use, Continued
The microwave was “bursty” because I kept turning it on and off to see how long it took ASA to detect it both coming and going. I found it took between 15 to 30 seconds from microwave on to an Interferer notification and about the same time from microwave off to when the Interferer notification went away. ASA will keep up to 24 hours of Interferer logs, which you can view by changing the drop-down selection. But note that Interferer logs aren’t saved if you shut down the program.
Figure 9: Two WLANs on Channels 1 and 6
(click image to enlarge)
Figure 9 shows the spectrum captured from two WLANs that I set up in the same room on Channels 1 and 6. What’s interesting here is that while both APs were about 3 feet apart on an open shelf and within 6 feet of both clients, there is a 16dB – about 40 X – difference between the Channel 1 and 6 signals.
I attribute the difference to the fact that the Channel 6 client was a notebook right beside the ASA notebook, while the Channel 1 client was a CardBus card in a CardBus-to-PCI adapter inserted into a PCI slot in the back of a desktop PC. A pretty convincing demonstration of why external antennas are a must for PCI-based wireless adapters!
Tip: I used the Delta Marker feature to take the above reading. There’s also a Single Marker that you can position at any monitored frequency – either by dragging the marker, using left and right arrow keys or entering the desired frequency directly – that displays frequency and amplitude at the marker.
Figure 10: Three bands w/ microwave interferer
(click image to enlarge)
Figure 10 shows one of ASA’s key advantages over BVS’ handheld devices. The larger screen real-estate of the notebook screen makes it possible to monitor multiple bands simultaneously – in this case the U.S. 802.11a, b and g bands. I actually grabbed this plot with the ASA notebook back in my office and the microwave running in the kitchen – two sheetrock walls and about 30 feet away. Since this time the microwave was running for a few minutes, I had plenty of time to capture the entry in the Interferer log.
I also took the ASA to all the WLAN test locations throughout my home while steady Channel 6 test signal was cranking away and found the ASA’s sensitivity was roughly in line with current-generation 11g WLAN cards.
Figure 11: All five bands
(click image to enlarge)
And as a final example of the ASA’s power, Figure 11 shows all five bands that it is capable of simultaneously monitoring. Actually, it can cover six bands, but since the 5.49 – 5.71GHz EMEA Middle (802.11 channels 100 – 140) and 5.47 – 5.725 GHz UNII bands overlap, you can’t do both simultaneously.
One thing I did notice, however, after gazing at this display for a minute or so is that all plots don’t consistently update each second. The 2.4 to 2.5 GHz plot seems to consistenly update every second, but the 5GHz band plots seem to skip a second or two, sometimes occasionally, or in the setup shown in Figure 10, updating only every three seconds. But even with this little glitch, this is pretty impressive capability!
I should note that I didn’t find the Air Quality plots – Duty Cycle, Log Power Average, Maximum Power, Pulse Duration, Pulses Per Second, Max Interfer Power, and Interferer Duty Cycle – very informative for my little test WLAN. But with busier airwaves to work with, I’m sure they’ll provide further insight to those more skilled in RF analysis.
Closing Thoughts
While ASA is functionally in pretty good shape for a 1.0 product, there is also room for improvement. I came up with this list of User Interface “issues”, some of which I admit could be considered personal preferences:
- The Spectrum feature can display up to nine plot sub-windows at once, but you can’t rearrange, resize or detach them. I’d prefer to see close, hide and restore boxes on each sub-window, too
- When working with the Power vs. Frequency plot, I first thought the ability to change the resolution bandwidth (RBW) was broken, since whatever value I set would get changed back to the original value. But I finally noticed that the desired value was shown in the display and that this was a bug with the control
- Opening a new plot is always done with all traces turned off, so nothing is displayed
- The mechanisms for changing Control settings are hidden until you click on them. This is ok once you get the hang of it, but I prefer visual cues to differentiate things I can change from those that I can’t
- You can save plot configurations, but can’t save any captured data other than by making screenshots
I’d also like to see versions of ASA covering other bands. AirMagnet has perhaps tipped its hand that 900MHz coverage is coming given the grayed-out selection in the Monitored Bands screen. So it’s probably not a stretch to think that versions covering other popular bands are also in the works.
I’m glad to see AirMagnet get a wireless LAN RF analysis product into the market, which has been pretty much dominated by BVS’ handheld BumbleBee and YellowJacket product lines. Of course there are always handheld general-use spectrum analyzers from companies like Willtek, Rohde & Schwarz, B&K and Anritsu. But these generally cost significantly more and could present a steeper learning curve given their more general-purpose nature.
As an RF analysis-only product, ASA is more comparable to BVS’ BumbleBee than its YellowJacket, which provides both spectrum analysis and decoded 802.11 data features. So what makes the AirMagnet Spectrum Analyzer worth almost $4000 while the Bumblebee can be yours for $2500 (sans Pocket PC)?
Not having had a BumbleBee to put through its paces, I can’t speak directly to its possible advantages. But AirMagnet and Cognio are emphasizing the ASA’s use of the more powerful notebook / tablet-based platform vs. BumbleBee’s PocketPC-based design. (Since AirMagnet has the benefit of user feedback – and sales volume history – for both PocketPC and Notebook-based products with its Laptop and Handheld Analyzer products, they know where their customers’ preferences lie.)
AirMagnet also feels that notebooks’ longer battery life, larger screen and more powerful CPU – not to mention the tiny CardBus form-factor of the measurement hardware – result in a more user-friendly and feature-rich product. ASA’s ability to display up to nine plots simultaneously, its more expansive array of plot types to choose from, and its automatic Interferer identification also contribute to AirMagnet’s view of ASA as a superior offering.
So while you may swallow a bit hard at the steep price tag, AirMagnet’s Spectrum Analyzer will be a powerful addition to any wireless LAN professional’s toolkit. But hey guys, given the top buck you’re asking for the product, let the Device Finder help track down 802.11 stuff too!