Softing IT Networks WaveXpert User manual

itnetworks.soing.com/waveXpert 1 itnetworks.soing.com/waveXpert
WLAN NETWORK SNIFFER
Manual

itnetworks.soing.com/waveXpert 2
CONTENTS
GENERAL INFORMATION ...................................................................................................3
Device descripon .............................................................................................................................. 3
Contents of the delivery ..................................................................................................................... 4
The key dierences between WaveXpert 1 and WaveXpert 2 ...........................................................4
WaveXpert hardware overview .......................................................................................................... 5
Control elements ................................................................................................................................ 5
Thunderbolt™ 3 socket .......................................................................................................................5
LED indicators ..................................................................................................................................... 6
External power connector (Power-in socket) ..................................................................................... 6
COMMISSIONING .............................................................................................................. 8
General hardware requirements ........................................................................................................ 8
Preliminary sengs ............................................................................................................................ 8
Commissioning ................................................................................................................................... 9
WAVEXPERT OPERATION ................................................................................................. 11
Interface/GUI .................................................................................................................................... 11
Connect to a network .......................................................................................................................12
Soware update ...............................................................................................................................12
Explanaon of the WaveXpert soware .......................................................................................... 13
FAQ ................................................................................................................................... 18
TECHNICAL SPECIFICATIONS ........................................................................................... 19
USE IN THE US/CANADA .................................................................................................. 20
!CAUTION
The CAUTION noce indicates a hazard.
A hazard can arise when an operaonal step or procedure is not properly executed or
complied with. This can result in damage to the product or the loss of important data.
Only proceed aer the CAUTION message once the displayed condions have been fully
recorded and implemented.

itnetworks.soing.com/waveXpert 3
GENERAL INFORMATION
DEVICE DESCRIPTION
The WaveXpert is for the recording and analysis of Wi-Fi transfers that are exchanged between two
or more parcipants. Wi-Fi transfers are recorded in accordance with the internaonal standard
IEEE 802.11a/b/g/n/ac. The parcipants whose dispatches are recorded can be mobile devices such
as smartphones, IP telephones or personal digital assistants (PDAs), but can also be permanently
installed equipment such as Wi-Fi access points, Wi-Fi printers or PCs with Wi-Fi cards. The special
feature of the WaveXpert is that management and control informaon in addion to usage data are
received in real-me and stored for further analysis. The device works exclusively in passive mode
and dispatches are only received; no data is sent.
The following Wi-Fi channels are supported:
• WaveXpert 1 (dual-band):
Channel 1 (2412MHz) – 13 (2472MHz) and channel 36 (5180MHz) – 165 (5825MHz)
• WaveXpert 2 (5GHz version):
Channel 36 (5180MHz) – 165 (5825MHz)
The WaveXpert is designed as a peripheral device for PCs with a Thunderbolt™ 3 port. The PC and
device are connected with a Thunderbolt™ 3 cered cable. The device can also be supplied with power
from the PC via this cable. In the case that the PC cannot supply enough power in certain situaons, an
external power supply connecon is available on the WaveXpert. This is intended for the connecon of
an external baery (powerbank), which then takes over the complete power supply for the WaveXpert.
The data recorded in the WaveXpert are transferred via the Thunderbolt™ 3 port to the PC and stored
in the memory. These data can be displayed and analyzed there.
A program is installed on the PC for the conguraon of the WaveXpert, such as the denion of the
receiving channels or the channel bandwidth.
!CAUTION
The combinaon of hardware and soware is exclusively intended for the recording
of Wi-Fi packet traces. Modicaons to the hardware and soware are not permied.
Any use outside of the intended task is prohibited.
We would like to expressly point out that modicaons by the user could void the
operang license. Soing rejects any liability.

itnetworks.soing.com/waveXpert 4
CONTENTS OF THE DELIVERY
GENERAL INFORMATION
• WaveXpert device
• Carry case
• Thunderbolt™ 3 cable
• USB-sck with operang soware
• Manual
THE KEY DIFFERENCES BETWEEN WAVEXPERT 1
AND WAVEXPERT 2
Feature WaveXpert 1 WaveXpert 2
Frequencies 2.4GHz & 5GHz 5GHz
Wi-Fi standards 802.11 a/b/g/n/ac 802.11 a/n/ac
Possible channel bandwidths 20/40/80 MHz 20/40/80/160 MHz
MIMO 3x3 4x4
Number of simultaneously recordable channels 4 channels 4 channels

itnetworks.soing.com/waveXpert 5
GENERAL INFORMATION
WAVEXPERT HARDWARE OVERVIEW
CONTROL ELEMENTS
The front panel shows the following elements:
THUNDERBOLT ™ 3 SOCKET
Only a special cable cered for Thunderbolt™ 3 may be connected in this USB-C socket.
Normal USB-C cables are not permied. Both passive and acve cables can be used, so long
as these are specied for at least 20GBit/s. It is recommended to use a cable that is as short
as possible.
Thunderbolt™ 3
port
Function indicators Power In socket

itnetworks.soing.com/waveXpert 6
LED INDICATORS
The meanings of indicator LEDs are presented in the following table:
 Light signal Meaning 
Power Extern
(green)
The external power supply is switched
on and is supplying the device
Run (green) The device is operaonal
Fault (red) An internal error has occurred Contact support
Overtemp (red) The internal temperature is too high Check that the cooling
vents are unobstructed

The PC may not be able to deliver enough power for the WaveXpert and it may be possible that the
maximum power supplied from the PC Thunderbolt port is not sucient in certain WaveXpert operang
modes. In this case, an external supply must be connected to the WaveXpert. Otherwise, this can lead
to malfuncons and also to data loss during recording.
An external baery, for example, can be used as an external supply for the WaveXpert. The connected
supply can have a voltage of between 12 and 20V and must supply at least 2A. Devices suitable for this
are those oered for the addional supply of laptops. Care should be taken to ensure that the connector
of this external supply is compable with the power socket of the WaveXpert.
The polarity of the contacts in the Power-in socket is plus on the inside and minus on the outside (see
following gure).
The center pin in the Power-in socket has a diameter of 2.5mm. The connector plugged in from the
outside must therefore have a slot for 2.5mm and an outside diameter of 5.5mm. These connectors are
common for notebook power supplies. The following image shows such a connector.
GENERAL INFORMATION
Mang Plug – Jack Inseron Depth: 8.2mm
5.5mm

itnetworks.soing.com/waveXpert 7
!CAUTION
The device must not be used when damaged. Before using the device, please check
the housing. Ensure that no cracks are present and that no plasc parts are missing.
The device should not be used in the vicinity of explosive gases, steam or dust.
Only use the device with the appropriate cable.
Observe all labels on the device before establishing a connecon.
Switch o the device and the power supply of the applicaon before connecng
the E/A connecons.
The connecon of voltage sources with more than 20V can irreversibly damage
the WaveXpert. This damage is not covered by the warranty. Take care that the cooling
vents on the sides always remain unobstructed.
Do not use the device if the cover has been removed or has become loose.
GENERAL INFORMATION

itnetworks.soing.com/waveXpert 8
COMMISSIONING
GENERAL HARDWARE REQUIREMENTS
A PC or laptop with at least one Thunderbolt™ 3 port is required to operate the WaveXpert.
The Thunderbolt™ 3 port is marked with the following symbol:
CAUTION: Older Thunderbolt™ 1 or 2 ports are not supported.
• A USB 3.0 or 3.1 port is needed on the PC for the provided USB-sck.
• Two WaveXpert devices on one PC are supported, so long as the PC has two Thunderbolt™ 3 ports.
• MacBook (Pro) and Mac systems are not currently supported.
The WaveXpert has an acve cooling system and two venlaon holes on the sides that must always
remain unobstructed. The cooling system is regulated and is only acvated when required.
An opcal indicator on the front warns the user of any overheang of the device.
PRELIMINARY SETTINGS
• 
• “Fast Startup” should be deacvated in Windows.
• Windows must be shut down beforehand (shutdown, not in sleep mode).
• 
• The documentaon of the respecve devices explains how and where these sengs can
be changed.
• “Secure Boot” should be deacvated. Under certain circumstances, this may result in Windows
no longer being bootable for the me of deacvaon.
• “Thunderbolt Security Level” should be set to “No Security”.
• Boong from the USB-sck in the legacy BIOS mode (not UEFI) must be selected.
Noce: Traces cannot be saved on the internal HDD/SSD without the aforemenoned sengs.
• The USB ash memory currently supports the legacy BIOS mode.
• The supplied operang system provides a 2GB RAM disk, which corresponds to the /tmp/ directory.
• Your own applicaons can be subsequently installed on the operang system as needed.
The memory for user-related sengs, to which addional applicaons also belong, is restricted to
approx. 2.5GB.

itnetworks.soing.com/waveXpert 9
!CAUTION
The Thunderbolt™ 3 connecon must not be disconnected under load. The “load” state
occurs when any acve recording of traces is carried out.
Even without acve recording, disconnecon of the Thunderbolt™ 3 connecon can in
rare cases lead to system crashes.
Aer disconnecon and renewed connecon of the Thunderbolt™ 3 connecon, it can
take some me under certain circumstances unl the adapter is once again recognized in
the system.
A maximum of 15 wa can be provided per Thunderbolt™ 3 to the WaveXpert. That is
why not all channel bandwidths are simultaneously adjustable on all adapters without an
external power supply to the WaveXpert.
With some notebooks and PCs, the maximum output of the USB-C Thunderbolt™ 3 port
is reduced to 7.4 wa (instead of 15 wa). This can later be changed in the BIOS/UEFI in
the case of most devices. If this is not possible, the WaveXpert must always be operated
with an external power source.
COMMISSIONING
Connect the supplied Thunderbolt™ 3 cable to the PC and the WaveXpert.
Insert the supplied USB-sck into a free USB port (USB 3.0 or USB 3.1) on the PC, remove all other ash
memories from the PC and switch the PC on.
To access the boot menu, repeatedly press either Esc, F8, F10 or F12 during startup, unl the selecon
of the startup medium is displayed. The buon that needs to be pressed for the boot menu depends on
the PC/BIOS and can be found in the manual of the respecve PC.
Select “USB Storage Device” under “Legacy” in the boot menu of the selecon screen.
Example of “Selecon of the startup medium” in the BIOS/legacy mode:
COMMISSIONING

itnetworks.soing.com/waveXpert 10
Note: The displays vary depending on the PC manufacturer and model. This gure only
shows an example (in this case Dell Latude E7390). The exact process is described in the
documentaon of the respecve PC.
A GRUB start menu (boot manager) is subsequently displayed:
The boot sequence will be automacally pursued aer 3 seconds.
Note: The boot sequence can dier with later versions, so that no further boot menu or boot
manager is displayed aer selecon of the USB boot sck under some circumstances. A successful
boot sequence is recognizable from the WaveXpert boot logo.
!CAUTION
The operang system is launched from a USB ash memory. The boot sequence
consequently lasts longer than is usually expected from an internal SSD memory.
The bandwidth of the USB ash memory is heavily restricted, especially in the case of
saving processes. Write values of up to 100MB/s should be possible with the supplied
USB ash memory. This limit is quickly reached during recording of four parallel Wi-Fi
channels according to IEEE 802.11ac or IEEE 802.11n, for example. In this case, delays
can occur to the nocaon (such as in Wireshark) or even to packet drops.
It is possible to write to an internal hard disk on which Windows is already installed,
so long as the following condions are met:
• The hard disk cannot be encrypted
• The Fast Startup funcon must be deacvated in Windows.
• Windows must be shut down beforehand using “Shut Down” and must not be in
“Sleep Mode”.
The Thunderbolt™ 3 security sengs in the BIOS/UEFI should be deacvated
(alternave mode: “No Security”). No funcon can be guaranteed with higher security
levels (modes: “User Authorizaon” and “Secure Connect”).
The USB ash memory with the operang soware must not be disconnected from
the PC during operaon.
COMMISSIONING

itnetworks.soing.com/waveXpert 11
WAVEXPERT OPERATION
• The WaveXpert operang system uses Linux Mint with the “MATE” interface.
• The “User” for the operang system is:
• The password, if necessary, is:

The interface follows the design of the Windows operang system. The desktop shows the most
important folders, links and the start menu in the boom le corner.
• usbdata
Folder/paron for storing traces. The paron lls the rest of the ash memory (approx. 30GB with
a 64GB model). The paron is formaed with NTFS so that it can also be read using Windows.
• Wireshark
Main program for recording and analysis of network protocol les.
• WaveXpert
Program for controlling the WaveXpert hardware and acvaon of Wireshark.
• 
With this update and installaon script, the WaveXpert soware can be installed or updated to
acvate the WaveXpert hardware.
• Menu
The program menu in the boom le corner shows all (pre-)installed programs. The system
can also be shut down and restarted here. Soware tools provided by the Linux system (such as
LibreOce for notes) that the user can use are displayed here. Soing IT Networks does not
provide any support for this.

itnetworks.soing.com/waveXpert 12
CONNECT TO A NETWORK
To connect the PC to a network, either connect a network cable or connect via Wi-Fi. Click on the
network icon in the lower right corner of the menu bar.
Wi-Fi networks found in the area are displayed here. If your Wi-Fi network is not included, select
“more networks”.
Click on your Wi-Fi network and enter your password.
SOFTWARE UPDATE
Before the rst use, you should check that the current WaveXpert version is installed and, if necessary,
run an update. Click on the “Install WaveXpert Ulity” icon to do so.
The currently installed version will be displayed. Answer the queson about the update check
with “Yes”.
It then asks for a proxy server. If you use a proxy server in your network, enter the IP address;
otherwise leave this eld empty and click on “OK”.
The soware now checks the server for newer versions and displays these. Select the latest version
for installaon.
WAVEXPERT OPERATION

itnetworks.soing.com/waveXpert 13
EXPLANATION OF THE WAVEXPERT SOFTWARE
WaveXpert – without aached hardware
WaveXpert – with aached hardware
External Power
Acvate when an external power supply such as a baery is connected
to the WaveXpert.
Adapter
Shows the list of recognized Wi-Fi adapters.
Channel
Conguraon of the Wi-Fi channel for each adapter
for 2.4GHz: 1 - 13
for 5GHz: 36 - 165
WAVEXPERT OPERATION

itnetworks.soing.com/waveXpert 14
Bandwidth
Conguraon of the Wi-Fi channel bandwidth (channel bonding) for each adapter
for 2.4GHz: HT20 = 20MHz, HT40+/HT40- = 40MHz (+,-)
for 5GHz: HT20 = 20MHz, HT40+/HT40- = 40MHz (+,-), HT80 = 80MHz
EXAMPLES
• Wi-Fi channel 36 without channel bonding (20MHz channel) = HT20
• Wi-Fi channel 36 with channel bonding channel 40 (40MHz channel) = HT40+
• Wi-Fi channel 48 with channel bonding channel 44 (40MHz channel) = HT40-
• Wi-Fi channel 100 with channel bonding channel 104, 108, 112 (80MHz channel) = HT80
Select
Acvaon and deacvaon of individual adapters when not in use. Recommended for
operaon via the 15W Thunderbolt™ 3 port and baery of the notebook.
“Start Wireshark menu”
Launches Wireshark with the selected adapter sengs and preselects the adapter.
No recording will be started. Further sengs can be congured.
“Run Wireshark capture”
Launches Wireshark with the selected adapter sengs and starts a recording on
the selected adapters in a temporary le.
WAVEXPERT OPERATION

itnetworks.soing.com/waveXpert 15
“Run long-term capture”
Long-term capture is for long-term recordings without a graphical interface. A folder selecon dialog
is displayed. Traces are created for each selected adapter every 5 minutes in the specied folder.
The recording is ended aer clicking on “Stop”.
WAVEXPERT OPERATION

itnetworks.soing.com/waveXpert 16
WAVEXPERT OPERATION
!CAUTION
The appropriate authorizaon must be obtained in advance when recording Wi-Fi data
from foreign Wi-Fi networks. Sensive and personal data may be recorded alongside.
The sending of packets is not intended and rendered impossible by means of the supplied
soware. The device is furthermore not authorized for this.
If the device is improperly used to send the packets (such as by using external soware
or operang system funcons), the user must assume full responsibility for this. This can
be an oense in some countries, for which the user is fully liable.
The memory space for user-related sengs is restricted to approx. 2.5GB. Larger les
such as traces should be stored on “usbdata”. This memory area lls up the rest of the
USB ash memory (this is equivalent to approx. 30GB in the case of some 64GB USB ash
memories). This memory is formaed with NTFS and can be read later using Windows.
If Wireshark is started without specifying an output le, a temporary le is created
in the /tmp/ directory. In the case of longer recording sessions, such as with the recording
of high data volumes/bandwidths, overow of the RAM disk can occur. The RAM itself is
also wrien to, which can also lead to memory overow.
“Wi-Fi scan”
A scan is done for available Wi-Fi networks and access points. The recognized
Wi-Fi channel, the bandwidth, the SSID, the MAC address of the AP (BSSID), and
the signal strength are displayed.

itnetworks.soing.com/waveXpert 17
WAVEXPERT OPERATION
“Tools”
Dedicated resets of the adapter or the interface can be iniated here in the event
of an error. The program already monitors for errors and automacally iniates a
reset of the interfaces in such an event.
“Help”
Opens a window in which all funcons are described.
Note: Details and explanaon on Wireshark can be found in the Wireshark documentaon.
!CAUTION
Not all packets can be added due to the intrinsic properes of a wireless transfer,
as well as due to the properes of the transfer technologies used. The following factors
can inuence the probability of the recording.
• Distance between the sender of the packet and WaveXpert
• Alignment of the WaveXpert with respect to the sender of the packet
• Data rate/modulaon at which the packet is transferred
• External interference/interfering signals
• Use of beamforming or mul-user MIMO with the Wi-Fi connecon to be recorded
Depending on the individual environmental condions, restricons can arise whereby
100% of all packets are not always recorded.

18
itnetworks.soing.com/waveXpert
FAQ

• Disconnect, wait for approx. 2 minutes and then reestablish the connecon.

• Disconnect and restart the system (reboot).
How can packet drops be prevented (at high bandwidths)?
• To prevent packet drops, the standard “interface kernel buer” of 2MB should be increased
to 30MB. A snap length of < 300 bytes is also recommended to also avoid losing any packets
with high-speed networks according to IEEE 802.11ac or IEEE 802.11n. Reducing the snap length
also reduces the stored informaon in each frame. The relevant radiotap header is sll included
with a snap length of 100 bytes. Details of a packet, such as the actual packet contents, are then
not saved.
• For long-term recording, the long-term capture funcon is strongly recommended.

• The lling up of storage media due to an ever-increasing le size can be prevented by a so-called
“ring buer”. This can be set in Wireshark under the tab “Capture/Opons/Output”. Check the
checkbox for “Use ring buer with” and select the number of les.

• For best possible recording of Wi-Fi communicaon, it is recommended to align the cover surface
of the WaveXpert in the direcon of the sender.
Informaon such as FAQs or workarounds are constantly being expanded and changed.
Please therefore inform yourself by vising our website: 

itnetworks.soing.com/waveXpert 19
TECHNICAL SPECIFICATIONS
 
 Thunderbolt™ 3
Connector USB-C connector
Cable between device and PC Thunderbolt™ 3-cered with a date rate of at least
20Gbit/s
Power input via Thunderbolt™

15 W (max)
 IP20
 Socket DC In 12V to 20V/2A (max)
5.5mm connector diameter
2.5mm center pin diameter
 0 - 35°C
10% - 90% rF non-condensing
Housing dimensions 200 x 135 x 40 mm
Weight (without cable) 0.5kg
 CE: RED Direcve 2014/53/EU
CE: ROHS Direcve 2011/65/EU
FCC: USA/Canada
Wi-Fi standard IEEE 802.11a/b/g/n/ac (up to 80/160 MHz)
 2.4GHz: 2.412 up to 2.472 GHz
5GHz: 5.180 up to 5.825 GHz
Max. channel bandwidth 20/40/80/160 MHz
 4

itnetworks.soing.com/waveXpert 20
USE IN THE US/CANADA
Notes for the use in the US/Canada:
FCC WARNING
Changes or modicaons not expressly approved by the party responsible for compliance could
void the user’s authority to operate the equipment.
NOTE
This device complies with Part 15 of the FCC Rules. Operaon is subject to the following
two condions:
1. this device may not cause harmful interference, and
2. this device must accept any interference received, including interference that may cause
undesired operaon.
NOTE
This equipment has been tested and found to comply with the limits for a Class B digital device,
pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protecon
against harmful interference in a residenal installaon. This equipment generates, uses and can
radiate radio frequency energy and, if not installed and used in accordance with the instrucons,
may cause harmful interference to radio communicaons. However, there is no guarantee that
interference will not occur in a parcular installaon. If this equipment does cause harmful
interference to radio or television recepon, which can be determined by turning the equipment
o and on, the user is encouraged to try to correct the interference by one or more of the
following measures:
• Reorient or relocate the receiving antenna.
• Increase the separaon between the equipment and receiver.
• Connect the equipment to an outlet on a circuit dierent from that to which the receiver
is connected.
• Consult the dealer or an experienced radio/TV technician for help.