One of the most useful features of AiroPeek is the 802.11 view on the Nodes tab. This presents an SSID Tree View of 802.11 access points and clients. By applying a simple filter, this view becomes even more useful when performing site surveys.
The SSID tree is built by looking at beacons as well as probe request and response packets. Many clients will go through a list of SSIDs and send out multiple probe requests before associating. Therefore, you may see many SSIDs that do not really exist in your network, especially from highly mobile users that maintain profiles for different sites and connections.
To see only the infrastructure present in your environment, make a filter that excludes probe request packets. The easy way to do this is to capture any probe request packet, highlight subtype “Probe Request” in the packet decode, right click to make filter, apply a “Not” to the pattern match, and rename the filter “802.11 No Probe Requests.” Of course, there will be times when you will not want the filter enabled, such as when diagnosing connection problems or when you wish to see all probe requests when checking for suspicious activity.
Site Survey Signal Strength? Caveat Emptor.
While on the subject, never rely solely on signal strength as you walk around and perform a site survey. For one, the reported signal strength will vary from one wireless NIC to another, depending on the vendor and model. Second, the signal strength will vary by the orientation of the antenna as you move your laptop/tablet around. But perhaps most important is that the signal strength of a client distant from an access point or your analyzer could be as strong as one much closer!
To test this, have a stationary AiroPeek monitoring a user with a laptop as they move farther and farther away from an access point. The client will drop the data rate down to maintain a good connection. Lower data rates have a stronger signal and propagate further. Unfortunately, lower data rates also consume more bandwidth. Therefore site surveys that rely solely on signal strength can be deceiving. For 802.11b, also turn on the 1, 2, 5.5 and 11 Mbps packet columns in the AiroPeek Nodes tab to see both the signal strength and the data rates being utilized.