Lab Spectrum Analyzer

Spectrum analyzers are a very important tool for anyone working in the wireless field. Getting one for your lab to get some hands-on experience with is invaluable. Unfortunately they can be very costly. Enter the Cisco 3502 series access point with Clean Air technology, available on E-Bay for less than $100. Utilizing the on-board spectrum chip we are able to turn this access point into a remote sensor for use with the Cisco Spectrum Expert software. This process also works for any of the Clean Air enabled access points.

While this functionality exists in both the lightweight & autonomous version of the access point, we are going to focus on setting this up in autonomous mode. You can easily convert from lightweight to autonomous, even without a controller, you will just need a copy of the autonomous image. An excellent write up on image conversion can be found at the following links http://mrncciew.com/2012/10/20/lightweight-to-autonomous-conversion/ & http://mrncciew.com/2013/12/13/ap-conversion-using-mode-button/.

My choice method is as follows, it seems to be the quickest & doesn't require holding down the mode button or re-configuring your computer. 

Console into the AP & login with the defaults. First we set the AP with a static IP & gateway pointing to itself. This seems to get the AP hung up on "Translating "CISCO-CAPWAP-CONTROLLER"...domain server (255.255.255.255)" allowing us to download the image before it forces DHCP renew which would disconnect us from the tftp.

AP1cdf.0f94.f201> AP1cdf.0f94.f201>en Password: Cisco (default) AP1cdf.0f94.f201# AP1cdf.0f94.f201#capwap ap ip address 172.16.0.250 255.255.255.0 AP1cdf.0f94.f201#capwap ap ip default-gateway 172.16.0.250

This debug command gets us into a mode that allows us to use the archive command, which we use to download an autonomous image over tftp.

AP1cdf.0f94.f201#debug capwap console cli AP1cdf.0f94.f201#archive download-sw /overwrite /force-reload tftp://172.16.0.3/ap3g1-k9w7-tar.153-3.JC.tar

After this the AP will reboot & come back up as an autonomous AP. It takes very minimal configuration to get it ready for spectrum mode.

examining image... Loading ap3g1-k9w7-tar.153-3.JC.tar from 172.16.0.3 (via BVI1): ! extracting info (278 bytes) Image info: Version Suffix: k9w7-.153-3.JC Image Name: ap3g1-k9w7-mx.153-3.JC Version Directory: ap3g1-k9w7-mx.153-3.JC Ios Image Size: 8489472 Total Image Size: 10486272 Image Feature: WIRELESS LAN Image Family: AP3G1 Wireless Switch Management Version: 8.2.100.0 MwarVersion:08026400.First AP Supported Version:07000000. Image version check passed Extracting files... <ommitted> [OK - 10526720 bytes] Deleting current version: flash:/ap3g1-rcvk9w8-mx... Set booting path to recovery image: 'flash:/ap3g1-rcvk9w8-mx/ap3g1-rcvk9w8-mx'... done. New software image installed in flash:/ap3g1-k9w7-mx.153-3.JC Configuring system to use new image.. Writing out the event log to flash:/event.log ... .done. Requested system reload in progress... archive download: takes 144 seconds Write of event.log done

Login to the device using the defaults & set a hostname, this step is optional.

ap>en Password: Cisco (default) ap#conf t ap(config)#hostname SE1

Enable the 2.4Ghz radio for spectrum operation & enable the radio.

SE1(config)#int dot11r0 SE1(config-if)#station-role spectrum SE1(config-if)#no shut

Enable the 5Ghz radio for spectrum operation & enable the radio.

SE1(config-if)#int dot11r1 SE1(config-if)#station-role spectrum SE1(config-if)#no shut SE1(config-if)#end

Take note of the NSI key from the output of show spectrum status, this will be needed when configuring Cisco Spectrum Expert. Also be aware that this value changes on reboot.

SE1#show spectrum status Spectrum FW status slot 0: version: 1.15.4 status: up, crashes 0, resets 0 load: 75.50 61.50 63.00 59.50 NSI Key: B7AE153050EC2C4C95E2965DDA02DFBE NSI: configured reg_wdog: 2 0 0 dfs_wdog: 2 dfs_freq: 0 Spectrum FW status slot 1: version: 1.15.4 status: up, crashes 0, resets 0 load: 23.75 21.75 22.00 21.75 NSI Key: B7AE153050EC2C4C95E2965DDA02DFBE NSI: configured reg_wdog: 0 0 0 dfs_wdog: 0 dfs_freq: 0 SE1#

Now that the AP is setup we'll need a copy of Cisco Spectrum Expert. This is available on Cisco's software site. Once downloaded run the installer & accept the defaults.

When you first load it up a box will pop up. This is where you enter the IP address of your remote sensor, the NSI key & the band you want to look at.

Click OK to be presented with loads of spectrum goodness

If you'd like to look at both bands simultaneously then you can just load up another instance of the software & point it to the other band instead.

Giving you even more spectrum goodness.

Now that you have an inexpensive spectrum analyzer for your home lab you can start learning about layer 1 with hands-on experience. While this solution is great for the lab it lacks in portability. For a more robust & easier to carry solution check out offerings from AirMagnet & Metageek.

WiFi Book Club Q1 2016

Welcome to the second edition of the WiFi Book Club! A series dedicated to getting the WLAN community reading & discussing the many books out there related to wireless. The goal is to read a book as part of the club once per quarter.

During the first month of a quarter I'll post a poll with a list of books to vote on. At the end of that month the votes will be tallied & the next book posted. A review & discussion of the current book will follow. Recommendations for books can be made via email, twitter, comments or carrier pigeon. While reading the book use the hashtag #WiFiBookClub to discuss on twitter. Authoring a book report is also a great way to get your creative juices flowing & add content to your blog.


Without further ado I present the next book up for review, Next Generation Wireless LANs.

"If you've been searching for a way to get up to speed on IEEE 802.11n and 802.11ac WLAN standards without having to wade through the entire specification, then look no further. This comprehensive overview describes the underlying principles, implementation details and key enhancing features of 802.11n and 802.11ac. For many of these features the authors outline the motivation and history behind their adoption into the standard. A detailed discussion of key throughput, robustness, and reliability enhancing features (such as MIMO, multi-user MIMO, 40/80/160 MHz channels, transmit beamforming and packet aggregation) is given, plus clear summaries of issues surrounding legacy interoperability and coexistence. Now updated and significantly revised, this 2nd edition contains new material on 802.11ac throughput, including revised chapters on MAC and interoperability, plus new chapters on 802.11ac PHY and multi-user MIMO. An ideal reference for designers of WLAN equipment, network managers, and researchers in the field of wireless communications."

Now to the part you've all been waiting for, the unboxing! Or maybe not. My order of the physical book was lost in transit, so I've gone the eBook route this time.

Opening the book gives you a nice About This Book popup.

Obligatory cover picture.

I've found the physical copy of this book on sale for a good bit cheaper than Amazon, notably at Abebooks. As always, do your research before purchase to make sure you are getting not only a good deal but the actual item you are looking for.

I'm really looking forward to reading this book & sharing in the discussion with everyone. Don't forget to send me your recommendations for future WiFi Book Club reads.