Open the new file and now we can configure the I/O Graphs. Once applied, export the displayed packets only to a new file that we’ll generate the graphs from. By matching on the first five octets of the AP’s BSSID rather than the exact BSSID, we preserve the beacon frames from all of the AP’s BSSID’s, which will gives us more data to calculate the RSSI of the AP. wlan.addr = aa:bb:cc:dd:ee:ff || ( wlan.ta contains 11:22:33:44:55 & wlan.fc.type_subtype = 8)Īa:bb:cc:dd:ee:ff is the MAC of the test client. 11:22:33:44:55 is the first five octects of the AP’s BSSID. We’re including the AP’s beacon frames so that we can see the changes in RSSI as the client moved away from then back towards the AP. First, let’s build a display filter to only show the frames to/from the test client, as well as all of the AP’s beacon frames. Now it’s time to look at the captured frames. Repeat as necessary until you have captured both a roam-away and a roam-back.

Take you Mac and the test client and move out of the current AP’s cell so the client roams away, then come back so that the client roams back. Discover the channel the test client is using, and start an over-the-air capture on that channel. Using a Mac laptop to capture frames on a single channel with Airtool, you can still get valuable information about the roaming performance of a Wi-Fi client with a few Wireshark display filters and some I/O Graphs magic. But what if you don’t have that, or want to do something quickly with a Mac without switching to Windows and hooking up your Wi-Fi adapter array?

I’m also impressed with 7signal’s recent update to Mobile Eye which now logs roaming data as well. Perhaps the gold standard is to follow the client with a laptop running Omnipeek and several Wi-Fi adapters all capturing frames on different channels. There are many ways to examine the roaming performance of a Wi-Fi client.

Wireshark mac specific process