Rolling Monitor Mode Packet Captures with Airtool

Do you troubleshoot client issues on a WLAN that are sporadic or only occur once or twice a day? If the answer is yes, then you should read this blog.

What is a rolling packet capture?

Performing a rolling packet capture allows you to save multiple pcap files that are usually separated by time, file size, or a number of captured packets There are manual ways to accomplish this using scripting. And there are applications that can do this work for you. Airtool (macOS only) is one of these applications and should be in every wireless engineer’s toolbox.

Rolling pcaps with Airtool

First download, install, and run Airtool.

When you run Airtool you will see a new icon in the macOS menu bar (it looks like a wrench inside of a WiFi connection icon). Click on this icon and Airtool’s options will be expanded.

Select “Preferences”. In the subsequent popup dialog there are settings we will use to configure rolling packet captures.

For our purposes, we will configure the following options:

•     Set “Limit each capture to: “200” “Megabytes”
• Larger file sizes use more resources and will make viewing/filtering your packet capture take significantly more time
  
• Depending on the machine you are using to open your packet capture you may want to drop the file size to 100 MB
•     Set “Files per capture:” to “10” and check “Rotate capture files”
• The maximum number of files you can save is 100
• It is important to ensure you have enough disk space available on your capture machine. 
• Multiply the capture size by the number of files to determine how much storage will be needed
• In our example we are going to use ~2 GB of disk space
  

Close the preferences dialog box to save these changes. To begin the packet capture, select the Airtool icon in the menu bar. In the dropdown, select the frequency, channel width, and channel.

You will see the following popup to indicate the packet capture is running.

Bonus section

When configuring a rolling packet capture, it may be beneficial to establish a baseline of how much traffic is being sent on the respective wireless channel. Monitoring the packet capture over 10 to 15 minutes, while users are actively using the network, can be extrapolated to better understand how much storage space will be needed.

Airtool also allows you to save packet captures without the layer 3 through 7 payload. Depending on the type of wireless troubleshooting you are performing, this may be a useful option to reduce your pcap file size.


Airtool homepage: https://www.intuitibits.com/products/airtool/

Now you have seen how helpful Airtool can be, I hope you find it as invaluable as I do.