Letters mosaic
Return to blog

Monitor Mode and Native Capture Mode in Acrylic Wi-Fi

Monitor Mode (Promiscuous Mode or Listening Mode) and Native Capture Mode or Normal Mode are the two modes supported by Acrylic Wi-Fi Professional and Acrylic Wi-Fi Heatmaps. Monitor mode can be activated in the following ways:

The information obtained about our Wi-Fi network will depend on the selected capture type.

Native Capture Mode

Acrylic Wi-Fi suite is compatible with all wireless cards in the market using Native Capture Mode or Normal Mode. When monitoring using Native Capture Mode, wireless cards operate as a standard Wi-Fi adapter.

By using Windows native mechanisms, the wireless card only captures a certain type of Management packets, specifically Beacon packets, that are broadcasted by access points. These packets are transmitted several times per second by access points to broadcast networks that are currently available.

Acrylic Wi-Fi tools analyze these packets, displaying all the information contained in them and saving this information into the current project.

To perform native data capture, there is no need for special hardware.

Monitor mode

Monitor mode is a data capture mode that allows using a WiFi adapter in listening mode or promiscuous mode. Operating in this mode, WiFi network cards are able to capture all types of WiFi Management packets (including Beacon packets), Data packets and Control packets. This way, it is possible to visualize not only access points but also clients that are transmitting within WiFi frequency bands.

There are 3 ways to activate it:

Using Acrylic Wi-Fi Sniffer

Acrylic Wi-Fi Sniffer allows monitor mode capture in a simple manner. Because it has been designed to be an easy-to-use and economical alternative to use monitor mode capture in windows, it can retrieve all available data including information about SNR (Signal-to-Noise Ratio) values.

SNR is a good parameter to measure the quality of a communication since it takes into account the received signal strength and the noise present in the wireless environment. Good values are those starting on 60.

SNR is available in both Acrylic Wi-Fi Professional and Acrylic Wi-Fi Heatmaps through Acrylic Wi-Fi Sniffer. Want to try it out?

It also supports the latest 802.11ac standards with all channel widths (20, 40, 80 and 160 MHz).

You can check out Acrylic Wi-Fi Sniffer compatible cards by clicking on this link

Using NDIS driver

NDIS driver is included in Acrylic Wi-Fi products and allows using monitor mode to capture traffic in 802.11a/b/g/n (20MHz widths) networks. A compatible card and the driver are required to activate monitor mode, which can be done from Acrylic WiFi application itself by clicking on the menu, pressing “change” in the WiFi interface selector and clicking on “Install NDIS Driver” button.

Using AirPCAP card

We can also capture WiFi traffic using monitor mode using specific WiFi analysis hardware, such as AirPcap cards, developed by Riverbed. These cards are currently discontinued and do not support new 802.11ac/ax standards. They support native capture and monitor mode. If you capture in monitor mode with an AirPcap card, you will be able to view, in addition to all data available with monitor mode using a card compatible with NDIS driver, information about SNR (Signal-to-Noise Ratio) values.

SNR is a good parameter to measure communication quality, since it takes into account the received signal strength and the noise present in the wireless medium. Its value ranges from 0 (weakest) to 100 (strongest). A value of 60 or greater is considered a good value.

SNR is available in both Acrylic Wi-Fi Professional and Acrylic Wi-Fi Heatmaps. Are you ready to give it a try?

Available information with Acrylic Wi-Fi Professional in the different modes (Native capture vs. monitor mode)

Native Mode

  • SSID
  • MAC address
  • Signal strength
  • Channels
  • Bandwidth
  • IEEE 802.11
  • Maximum packet transmission rate
  • Encriptation type (WEP, WPA, WPA2, WPS, WPS PIN)
  • Password
  • Manufacturer
  • AP first detected time
  • Type of established connection
  • Latitude and longitude (this information is available when a GPS device is connected)

Monitor mode

While performing a data capture in monitor mode, Acrylic Wi-Fi Professional provides, in addition to all the information available with the normal mode capture, information about the following aspects:

  • Client devices connected to the different access points (#)
  • Retries of sent packets (Retries)
  • Data packets (Data)
  • Management type packets (Mgt)

Plots available in different modes using Acrylic Wi-Fi Heatmaps (Normal mode vs Monitor Mode)

In Acrylic Wi-Fi Heatmaps, the native capture mode, compatible with all wifi cards on the market, allows generating the following charts and diagrams (plots).

  • RSSI (Signal strength)
  • AP coverage
  • Channel coverage,
  • Maximum transmission rates supported
  • Number of APs
  • Channel overlapping
  • Cell-grouped data
  • Bandwidth*
  • Latency*
  • Packet loss*
  • Roaming*

*Plots available when performing an active site survey.

Normal Mode

Charts available when capturing in native mode:

Monitor Mode

When performing data capture in monitor mode, in addition to all plots available using normal mode, we can show:

  • Cell Density (the density of devices connected to access points)
  • Retries rate
  • SNR*

* Available using Acrylic Wi-Fi Sniffer or an AirPcap card

Acrylic Wi-Fi Sniffer allows capturing traffic transmitted using the latests 802.11ac standards with channel widths of 20, 40, 80 and 160Mhz. This enhancement applies to all software plots.

As you can see in the image, RF Spectrum graph is not available in any mode. This is because it is only available by using a specific device: a spectrum analyzer. If you want more information about what this chart is for, how to activate it and how to use it, please take a look at the article “Wi-Fi Spectrum Analysis, How to Perform One, and What Information It Provides

Leave a comment