sniffwifi

Just another WordPress.com site

Archive for June 2013

iPhone 5 Probes the Right Way, Too

with 2 comments

Quiet when standing still; active when moving.  That is the way that WiFi devices should treat Probe Requests.  Android devices (at least, Android devices that act like yours truly’s Samsung Galaxy Tab 2) probe the right way.  After doing a quick test on the iPhone 5, it appears that Apple has their devices probe based on movement as well.

Apple iOS devices have a terrible reputation in some WiFi circles.  The author has heard complaints about mobility, stickiness, throughput capabilities and just about anything else under the sun.  Heck, just today an article was published decrying the throughput (WHO CARES?) limitations of of the new MacBook Air (not iOS, but still Apple) was viral’d around the web.

To check to see if the iPhone 5 matches the probing behavior of an Andoid device, I associated the iPhone to the office network on channel 36/+1 and started a capture on channel 44/+1.  Then I got up from my chair and started walking around while continuing to use the iPhone.

The results were this:

Notice that the Probe Request frames started coming out immediately when my phone began moving, but then stopped less than one second later.  Most likely what happened was that when I got up from the desk, the iPhone sensed movement and began probing for the next highest 40 MHz channel.  Then the phone probably went from channel to channel as it continued to probe.  All the while the phone continued to stay on channel 36/+1 as much as possible in order to keep communication with the network.
Of course it is hard to draw firm conclusions from a few minutes worth of Wireshark captures, but to these eyes it appears that Apple may be taking steps to get iOS devices in the good graces of WiFi admins and other professionals.  

Advertisements

Written by sniffwifi

June 24, 2013 at 11:13 pm

Galaxy Tab 2.0: Probing Done Right (I Think)

with 5 comments

When we last left off, yours truly had noticed that an Android tablet was probing for Wi-Fi networks even when associated.  This behavior would have been unusual, as consumer-grade Wi-Fi devices historically would probe when unassociated and stop probing once a connection is made.  After a little bit more investigation, it appears there was an extenuating circumstance that was causing all of the extra probing.

I wondered if the Android tablet I have (Samsung Galaxy Tab 2.0 with 65 Mbps 802.11b/g/n WiFi) might have its probing behavior affected by movement, and sure enough it does.

I’ll try to amend this blog post later to add screenshots of my captures, but for now here is a summary of what I saw:

I associated my Galaxy Tab to a WLAN that is on channel 1.  Then I captured on channel 11.  My hypothesis is that an associated device should stop probing on other channels as long as the signal is solid.

Sure enough, once I was associated on channel 1, I stopped seeing Probe Requests coming from the Galaxy Tab on channel 11.  In fact, channel 11 showed no sign of the Galaxy Tab whatsoever.  (What was also interesting that is the only SSIDs I saw in the Probe Requests before the Galaxy Tab associated were hidden SSIDs.  Maybe Android has taken the Windows/Apple iOS approach and enabled probing only for hidden SSIDs.  That’ll be another investigation for another time.)

I started walking with the Galaxy Tab, but made sure that I walked only in areas where the received signal was strong (meaning well above -70 dBm).  My channel 11 capture then started lighting up with Probe Request frames from the Galaxy Tab.  The probing was exclusively using the SSID of the WiFi network I was associated to.

The conclusion I reached (at least so far) is that the Galaxy Tab is doing the right type of probing.  The harm of Probe Requests is that they take up valuable channel time and may open up devices to hijacking attacks.  The value of Probe Requests is that they aid mobility.  It appears that when the Galaxy Tab senses movement, the positive aspect of probing is used.  When the device lies still, the negative aspect of probing is avoided (as long as the Galaxy Tab stays associated).

Written by sniffwifi

June 13, 2013 at 11:09 pm

That Android is Quite the Prober

with 2 comments

No bold type introducing today’s post, as I’m going to keep things short.

I was doing some work last week looking at Android devices (specifically, a Samsung Galaxy Tab 2) and I noticed some very heavy probing behavior.  We were checking out the device’s behavior when it moves from AP to AP, so I set a capture for the target second AP.  I did the test (things went fine, but the WiFi Analyzer app in particular seems to really make Android devices stick to their currently associated BSS) and looked at the capture.

Seeing a ton of Probe Requests from the Tablet was expected.  What wasn’t expected was the Android tablet probing even while associated to the first AP.  Even when the received signal was strong (in the -50 to -63 dBm range), the Android was going off channel to probe and probe excessively.

At this point I’m still trying to figure out if physical motion or an app (or lack thereof) caused the probing.  One thing I am pretty confident in saying already is that updates to Android OS and iOS (the one for iPads and iPhones, not the Cisco one) have really seen the two leaders in mobile operating systems take divergent paths concerning WiFi overhead.  Apple seems to be making their smartphones and tablets probe less, while Android devices are probing just as much, maybe even a little more.

Written by sniffwifi

June 3, 2013 at 10:36 pm