Lab Spectrum Analyzer

Spectrum analyzers are a very important tool for anyone working in the wireless field. Getting one for your lab to get some hands-on experience with is invaluable. Unfortunately they can be very costly. Enter the Cisco 3502 series access point with Clean Air technology, available on E-Bay for less than $100. Utilizing the on-board spectrum chip we are able to turn this access point into a remote sensor for use with the Cisco Spectrum Expert software. This process also works for any of the Clean Air enabled access points.

While this functionality exists in both the lightweight & autonomous version of the access point, we are going to focus on setting this up in autonomous mode. You can easily convert from lightweight to autonomous, even without a controller, you will just need a copy of the autonomous image. An excellent write up on image conversion can be found at the following links http://mrncciew.com/2012/10/20/lightweight-to-autonomous-conversion/ & http://mrncciew.com/2013/12/13/ap-conversion-using-mode-button/.

My choice method is as follows, it seems to be the quickest & doesn't require holding down the mode button or re-configuring your computer. 

Console into the AP & login with the defaults. First we set the AP with a static IP & gateway pointing to itself. This seems to get the AP hung up on "Translating "CISCO-CAPWAP-CONTROLLER"...domain server (255.255.255.255)" allowing us to download the image before it forces DHCP renew which would disconnect us from the tftp.

AP1cdf.0f94.f201> AP1cdf.0f94.f201>en Password: Cisco (default) AP1cdf.0f94.f201# AP1cdf.0f94.f201#capwap ap ip address 172.16.0.250 255.255.255.0 AP1cdf.0f94.f201#capwap ap ip default-gateway 172.16.0.250

This debug command gets us into a mode that allows us to use the archive command, which we use to download an autonomous image over tftp.

AP1cdf.0f94.f201#debug capwap console cli AP1cdf.0f94.f201#archive download-sw /overwrite /force-reload tftp://172.16.0.3/ap3g1-k9w7-tar.153-3.JC.tar

After this the AP will reboot & come back up as an autonomous AP. It takes very minimal configuration to get it ready for spectrum mode.

examining image... Loading ap3g1-k9w7-tar.153-3.JC.tar from 172.16.0.3 (via BVI1): ! extracting info (278 bytes) Image info: Version Suffix: k9w7-.153-3.JC Image Name: ap3g1-k9w7-mx.153-3.JC Version Directory: ap3g1-k9w7-mx.153-3.JC Ios Image Size: 8489472 Total Image Size: 10486272 Image Feature: WIRELESS LAN Image Family: AP3G1 Wireless Switch Management Version: 8.2.100.0 MwarVersion:08026400.First AP Supported Version:07000000. Image version check passed Extracting files... <ommitted> [OK - 10526720 bytes] Deleting current version: flash:/ap3g1-rcvk9w8-mx... Set booting path to recovery image: 'flash:/ap3g1-rcvk9w8-mx/ap3g1-rcvk9w8-mx'... done. New software image installed in flash:/ap3g1-k9w7-mx.153-3.JC Configuring system to use new image.. Writing out the event log to flash:/event.log ... .done. Requested system reload in progress... archive download: takes 144 seconds Write of event.log done

Login to the device using the defaults & set a hostname, this step is optional.

ap>en Password: Cisco (default) ap#conf t ap(config)#hostname SE1

Enable the 2.4Ghz radio for spectrum operation & enable the radio.

SE1(config)#int dot11r0 SE1(config-if)#station-role spectrum SE1(config-if)#no shut

Enable the 5Ghz radio for spectrum operation & enable the radio.

SE1(config-if)#int dot11r1 SE1(config-if)#station-role spectrum SE1(config-if)#no shut SE1(config-if)#end

Take note of the NSI key from the output of show spectrum status, this will be needed when configuring Cisco Spectrum Expert. Also be aware that this value changes on reboot.

SE1#show spectrum status Spectrum FW status slot 0: version: 1.15.4 status: up, crashes 0, resets 0 load: 75.50 61.50 63.00 59.50 NSI Key: B7AE153050EC2C4C95E2965DDA02DFBE NSI: configured reg_wdog: 2 0 0 dfs_wdog: 2 dfs_freq: 0 Spectrum FW status slot 1: version: 1.15.4 status: up, crashes 0, resets 0 load: 23.75 21.75 22.00 21.75 NSI Key: B7AE153050EC2C4C95E2965DDA02DFBE NSI: configured reg_wdog: 0 0 0 dfs_wdog: 0 dfs_freq: 0 SE1#

Now that the AP is setup we'll need a copy of Cisco Spectrum Expert. This is available on Cisco's software site. Once downloaded run the installer & accept the defaults.

When you first load it up a box will pop up. This is where you enter the IP address of your remote sensor, the NSI key & the band you want to look at.

Click OK to be presented with loads of spectrum goodness

If you'd like to look at both bands simultaneously then you can just load up another instance of the software & point it to the other band instead.

Giving you even more spectrum goodness.

Now that you have an inexpensive spectrum analyzer for your home lab you can start learning about layer 1 with hands-on experience. While this solution is great for the lab it lacks in portability. For a more robust & easier to carry solution check out offerings from AirMagnet & Metageek.