CWNP - Any Airopeek NX gurus here?

Author

Any Airopeek NX gurus here?

meijin

2003-10-01, 5:14 pm

If there is anyone here familiar with the tool, I have a question.

On a system that I am testing, I am getting what I consider to be an unusually high number of Broadcast Sotrms, Multicast Storms, CRC Errors and Physical Errors. When Airopeek reports these, I am using the default thresholds. Can anyone say that these thresholds are OK to use or should they be modified in any way?

Looking forward to your comments.

Thanks!

loraan

2003-10-03, 1:43 am

Meijin,

My name is Joshua Bardwell, and I'm a Technical Instructor and Network Engineer with WildPackets. I'm also a CWSP. I can help you with your question.

You're right to consider carefully whether AiroPeek's expert thresholds are appropriate for your network. We set the thresholds to values that we believe are appropriate for the "average" network, but everyone should check the appropriateness of the thresholds before concluding that the expert's diagnoses are truly indicative of a problem. We say that the expert can tell you when there might be a problem, but it's up to you to judge if there really is a problem.

Regarding the specific problems you reported:

- Broadcast storms. Wireless networks inherently have a high amount of broadcast traffic. EtherPeek's default is 40 packets / second for more than 2 consecutive seconds. Since APs send beacons ten times per second, if you have more than four APs in range of AiroPeek, then you're guaranteed to see a lot of the broadcast storm diagnosis. In reality, it would take fewer than four APs because wireless stations also normally send a lot of broadcasts. We used a default threshold of 40 packets / second because most networks will probably not have three or four APs on a single channel.

Multicast storms: I can't say why you're seeing multicast storms. 802.11 networks use the broadcast address, not any particular multicast address. AiroPeek's default setting is pretty generous, so if you're seeing this, you should investigate.

The bottom line with broadcast and multicast storms is that you need to investigate what is causing that traffic. Use Select Related to extract all packets to the broadcast address and all multicast addresses from the trace. Then examine the protocol in the packets and the source stations. Is this traffic normal and expected on your network or is it abnormal?

Error and CRC packets: AiroPeek has specific packet per second thresholds for corrupted frames, but a general threshold you can use is if less than ten percent of the packets in a trace are corrupted, you're probably okay. Ten to twenty percent is acceptable but undesirable. Twenty percent or higher is probably unacceptable. Remember that wireless networks will have a higher percentage of corrupted frames than a wireless network. In addition, remember that AiroPeek's physical location can cause it to see a corrupted frame when the AP and station both saw a good frame. E.g. imagine a scenario where AiroPeek is far from both the AP and the station. AiroPeek will have weak signal strength and see tons of corrupted packets even if the AP and station are seeing each other just fine. To evaluate this, place AiroPeek as close to the AP as possible, that way you are likely to see what the AP is seeing in terms of signal strength and corruption.

Joshua Bardwell
Technical Instructor/Network Engineer
CWSP Certified Instructor
WildPackets Inc.

meijin

2003-10-03, 1:48 am

Joshua:

You don't happen to be the instructor teaching the WP-106 class in San Jose the second week of October are you? Maybe Keith Parsons mentioned you to me...but I know that name.

Anyway...I'd love to talk to you off line..and if you are teaching that class...I'd like to buy you dinner one night.

Just cannot figure out where I know the name from...

I'll drop you a line privately...

Thanks for the insight!

loraan

2003-10-08, 11:38 am

I am a WildPackets instructor, but I'm not teaching the San Diego class. It's a little bit late for me to post this, since you're in the third day of that class right now...

meijin

2003-10-08, 11:55 am

Not late at all! Actually, the class is next week. I fly out on Sunday.

Can you tell me anything about the class? I know it is a modified CWNA class...so I really hoping that they can squeeze alot of Airopeek into it.

Thanks!

Sponsored Links