Data Tables

Summary of Findings

Device Classification

Captures are assessed for devices that can be classified with reasonable confidence based on frame data and behavior. The following section lists tables that are used to classify and describe the devices that are represented in wireless captures.

Basic device information is provided based on inferred device class and inventory, device taxonomy and wireless ecology.

Device variants

The Analysis module provides the following device class information.

Device Class Table -- Module 1

Infrastructure

This table summarizes and describes the wireless infrastructure that was observed at the site. This includes access points (APs), mesh nodes, extenders, and hotspots.

Client Activity

This table describes the client activity that was observed at the site. This includes client and scanner behavior.

Vendor OUI

This table provides a summary of the vendor names and OUIs that the observation discovered at the site. Context By Signal uses this information to report manufacturer attribution and confidence findings.

Channel Utilization

This table provides a measure of channel crowding or "co-channel pressure." High airtime utilization is associated with visible AP density and increased risk of radio frequency (RF) contention. The higher the channel device count, the greater the competition for airtime. The result is latency, dropped connections, and degraded performance. Channel utilization is derived from AP count and RSSI.

Channel utilization is subject to channel overlap. This affects the 2.4 GHz band; the 25 channels on the 5 GHz band do not overlap at 20 Mhz wide. Co-channel pressure is adjusted based on channel overlap as follows:

Signal Strength

Received Signal Strength Indicator (RSSI) measures the power of a radio signal on receipt. RSSI is commonly used in wireless protocols, for example, in 802.11 (WiFi), Bluetooth, and ZigBee.

The RSSI field is found in 802.11 packets only when the capture is made with RadioTap headers. In some capture tools, inclusion of the RadioTap header is optional and must be selected. Context By Signal assumes the inclusion of the RadioTap header in packet captures.

RSSI is influenced by variables including the presence of walls, interference, antenna orientation, transmit power, signal reflections, and device hardware. This means that RSSI should be treated as an approximate indicator of relative signal strength rather than an exact measure of physical distance.

The following table lists RSSI values and how they are interpreted within the context of an 802.11 frame capture.

The RSSI values of 802.11 transmitters vary from frame to frame. For transmitters whose incidence persists across the timestamps of a capture, this variance might fall into a range or a pattern. The following table provides examples of RSSI patterns relative to the transmitter and their physical interpretation.

Persistence

Persistence is a measurement of presence, channel "occupancy" across time. Context By Signal measures persistence as a continuing presence across the timestamps of an Airtool capture, in the accumulation of frame counts within the bounds of a capture, and in occupancy across collections of capture files. The cross-file continuity value is omitted for analysis jobs that include only one capture file. Persistence is described by MAC.

Travel mode

Site Fingerprint

Observation Constraints

Reasons To Doubt

Evidence

Anomaly

Structural Artifacts