This radio cannot tune above 5 GHz, so these entries were
never heard directly. They come from the Reduced Neighbor
Report element that an AP puts into its 2.4 and 5 GHz
beacons to announce its co-located 6 GHz BSSs, which is how
clients find them without scanning the band. A name is shown
when the report says the BSS carries the same SSID as the
announcing AP, or when its short SSID, a CRC-32 of the name,
matches a network already known here.
Click a column header to sort, hover for full details,
click a bar to restrict the sweep to that channel. An SSID
marked with * came from a directed probe or association
request, not from the beacon: the network hides its name. The
pcap link in each row exports the newest beacon of that BSSID
on its own, the full buffer is available in the scan panel. An
entry marked [mesh] is an 802.11s mesh point, whose SSID
element is empty by design and whose name is the Mesh ID
from element 114.
Live RSSI spectrum
Waterfall (same time range)
Waterfall: one column per scanned channel, equal column
width, time running from top to bottom.
Stations per AP
Associated stations
Probing only, not seen on any BSS
Stations that associated, kept permanently
The Associated and Probing only tabs age entries out after
the station timeout. This one does not: every station whose association
or reassociation request was decoded stays here until the
device reboots or the table is cleared. An association
request names the station, the BSS and usually the network in
clear and is seen only at the moment a station joins, so it
is worth keeping long after the station itself has gone
quiet.
An AP name in green was learned from a directed probe or an
association request of a station, not from a beacon: that AP
is out of range, on a channel that is not being swept, or
hiding its SSID.
The pcap link in each row exports the probe and association
requests of that station that are still in the ring buffer.
Stations are split into those seen on a BSS and those only
ever heard probing; a station keeps its data when it moves
over. A green row means at least one association request was
captured, so its capability data is the complete set rather
than the subset a probe request carries.
Clicking an AP node keeps its tooltip open; its scan only
channel button restricts the sweep to that channel, which
captures far more traffic. Stations are derived from
data frames (ToDS/FromDS), probe requests and
(re)association requests. To AP / From AP are frame counts,
byte counts are in the tooltip. Peer is Addr3, the address
behind the AP. Capabilities from probe requests are often
incomplete and only become complete in the association
request. Randomised MACs without an association are dropped
after 30 s.
Elements to look at in Wireshark
not decoded, or decoded only in part (marked parsed)
Type
Number
Vendor
Subtype
Name
Seen in
Count
First seen
Last seen
Example
Ch
Frames
pcap
What this sensor reads
Meant for carrying the sensor around, without a network: with
recording on, every beacon, probe response, probe request and
association request is searched for what the firmware does not
read, or reads only in part. That is any element it does not
know, any vendor specific element it does not decode, any AKM or
cipher suite it has no name for, and Interworking (107), of which
only the network type and venue are shown. Each gets one row with
a counter, the frame types it came in, when it was first and last
seen, and one example: the sender, its SSID or the network it
asked for, and the channel. The first three frames
carrying it go into a pcap file for Wireshark. The pcap link of a
row hands out every stored frame that carries the element, which
can be more than the three kept for it, the full set comes from
the button below the table.
The catalog lives in the flash and survives reboots and power
cuts; new rows are written within seconds, counters every five
minutes. Without a clock (no NTP, no browser, no AP sending a
Time Advertisement) a time is given as the boot and the time
since it. Flashing a new firmware keeps the catalog; only a
full flash image or an erase removes it.
BLE advertising
Advertising channels 37/38/39 only. Data channels of
established connections cannot be sniffed with this
controller. A passive scan transmits nothing, an active
scan also collects scan responses (more names, but the
analyzer becomes visible itself). The address type comes
from the top two bits: resolvable private addresses rotate
and are therefore useless for tracking.
Sensor
The sensor id is the board's MAC and stays; the name is free and goes into the export, the snapshots and the DHCP hostname. The settings page does not change the radio mode, the scanner keeps running in whatever mode it was in.
Firmware
Time
The timezone shifts displayed times only. Inside the device
everything stays on UTC — the capture timestamps, the
export and the clock arithmetic — so a capture taken
here still lines up with one taken anywhere else. There is no
daylight saving rule on board; pick the offset that applies.
Timezone
Ethernet
DHCP
Sweep and frames
Capture
Stored on the sensor
Each ring keeps the newest; once full the oldest go, as designed. download all gives a pcap for Wireshark, clear empties only that store. The association history holds station records, not frames, so it has nothing to download.
Store
Fill
Size
Graphs recorded
The Graphs tab of a pinned tooltip records its BSS while it is open.
With keep recording without this tab the sensor goes on
without it, also after a restart (the samples start anew then), until
it is unticked or stopped here. Four at most at once, 24 hours each;
CSV gives the samples, one line per 5 s step.
Snapshots
A snapshot keeps what the page shows at one moment on the
sensor's flash, the last ten (fewer when the tables are full and
the flash runs short); Keep chooses what goes in,
stored on the sensor. The camera button next to the status badge
takes one from any view, and so does a short press on the board's
BOOT button, without the page; the LED blinks green twice
when it is written, red when it failed. View shows it with the
usual tables and tooltips until Back to live. Export
saves one as a .zip, Export all every one in a single .zip;
Import puts such files on a sensor again, this one or another,
where they count as the newest. View file shows a file without
putting it on the sensor, also without one; Clear all
deletes every snapshot on the sensor. The capture buffers are
not included: the pcap links in a snapshot ask the connected sensor
for what it holds now, so the frames may be gone, and for a snapshot
from another sensor they were never there; the message then says so.
Keep:
Export
/api/export returns everything this sensor knows as one JSON
document, meant to be merged with other sensors covering the
same area. Captured frames are not included, those stay
behind /api/pcap. Every timestamp is absolute UTC epoch
seconds rather than an age, so records from several sensors
line up. Narrow the document with sections=networks,clients
and with since=<epoch> to get only what changed.
Event log
Configuration changes with the address they came from, newest
first, 20 to a page. The last 80 entries are kept on the device's flash, so they
survive a restart and a power cut; each start is logged with its
reason (power on, crash, watchdog, restart by the firmware); after a
crash the box above the table holds its core dump. Entries
from an earlier start have no age when the clock was not known
then.
Time
Age
From
Event
CPU
Shares of the last 10 s, from the run time FreeRTOS counts for every
task; the load is what the idle task did not get, interrupts count
for the task they interrupt. loopTask runs the parser and the
web server, wifi and tiT (lwIP) the radio and the
network. While loop() answers a request it reads no frames: the
management queue fills up and, once full, frames are dropped. The
temperature is the chip's own, not the air around it.
Memory
Tasks
Task
CPU
Stack never used
Allocated buffers
IEEE 802.15.4 / Zigbee / Thread
Energy waterfall
Two independent modes. Frame capture decodes 802.15.4
traffic; the energy waterfall measures raw power in each
channel and therefore also shows everything that is not
decodable at all: microwave ovens, video senders, hopping
Bluetooth links, wireless mice, broken transmitters. Only
2.4 GHz, since the 802.15.4 receiver does not go anywhere
else, and the levels are relative to that receiver rather
than calibrated dBm.
Channels 11 to 26, 2405 to 2480 MHz, 2 MHz wide with 5 MHz
spacing. The bar is the energy detect reading of the radio,
which shows a noise floor even when nothing is transmitting;
the marker is the strongest frame actually decoded on that
channel. Addresses come from the MAC header of promiscuous
frames, so encrypted payloads do not matter. Frames from a
network the sniffer is not part of are still counted, only
their contents stay opaque.