Review: Free and low-cost Wi-Fi stumblers for the Mac
By Eric Geier (Our Owner & Lead Wi-Fi Consultant)
Originally published on NetworkWorld
We recently reviewed low-cost Windows-based Wi-Fi stumblers. Now, here’s our take on wireless stumblers that run on Mac OS X for all you Apple fans.
The six products we looked at are: AirRadar 3, iStumbler, KisMAC2, NetSpot, WiFi Explorer, and WiFi Scanner. Pricing ranges from free to $149, all at least require Mac OS X 10.6 Snow Leopard, and most require an internal AirPort Wi-Fi card.
We also wanted to include AirGrab WiFi Radar, inSSIDer Office, and Kismet, but AirGrab and the popular open source Kismet program wouldn’t work on our MacBook Air (13-inch, early 2014) running OS X 10.10. The Mac Edition of inSSIDer Office was still in beta, but it looks nearly identical to the Windows Edition, which we recently reviewed.
Hidden SSIDs and Mac OS X
Due to the current limitations of Apple’s CoreWLAN API, most Wi-Fi stumblers for Mac OS X don’t fully support hidden SSIDs. This means a hidden SSID usually won’t appear on the network list at all. By contrast, most Windows-based stumblers would typically list it with a blank/unknown SSID.
But there’s an exception; some Mac-based stumblers will show the hidden SSID and its details after you connect to the SSID. However, this doesn’t help when you don’t know if they exist. This is why I’d caution against solely using a Mac-based stumbler when surveying, troubleshooting, and auditing Wi-Fi networks.
From what we could gather, it appears some Wi-Fi tools that support non-AirPort drivers will recognize and even reveal hidden SSIDs, such as KisMAC2 and Kismet. Though we reviewed KisMAC2, we were only able to utilize the internal AirPort card of the MacBook, thus unable to test out the hidden SSID capability.
There’s no big winner or loser in this review, but we did like WiFi Explorer as a basic stumbler. Each product in this review has pros and cons, depending on your particular needs. The only one we’d caution against is KisMAC2 because it lacks some basic functionality and documentation. On the other hand, it is the only one reviewed that’s supposed to fully support hidden SSIDs. Here are the individual reviews:
AirRadar 3
AirRadar 3 is a basic Wi-Fi stumbler sold by Koingo Software, which also develops other apps for Windows and Mac. It provides a fully functional trial for 15 days. The application runs on Mac OS X 10.7 and later. It works with the internal AirPort adapter, or an external USB adapter if using Apple Airport hardware and drivers.
Pricing is $99 for up to 10 Macs in a business, and $295 for corporate licenses covering unlimited Macs.
The program has three main screens, which you navigate to by the buttons on the top of the application.The default screen is the Scan page showing the network list. The SNR values are not shown at all, but it’s on their list of features coming soon. Supported data rates of the networks aren’t given either.
The signal and noise levels are supposed to be available in both percentages and negative dBm values, but we could not get the dBm values to show, despite enabling the option in the Advanced tab of the Preferences.
Selecting a network(s) from the list will show their signal graph above the list, again using only percentage values. However, you can optionally have noise also shown on the graph alongside the signal. Right-clicking a network allows you to connect to it, save notes, add to favorites, assign a color label, or reset its stats.
On the left side of the Scan page, you can select and manage the Collections, which are basically saved filtering settings. By default, there are Collections to show networks based upon their supported 802.11 standard, security status, and one to show ad-hoc networks. You can also add custom Collections, groups of networks, and Smart Collections to apply specific filtering settings based upon any of the network details.
On the bottom of the Scan page you can conveniently search for a specific network, connect to a selected network, or stop/start the scanning.
The Statistics page shows the number of networks that are open (unsecured) and closed (secured). Also displayed are the number of ad-hoc and regular networks. Additionally, each 802.11 standard is listed (including the new 802.11ac) along with the amount of networks that support them.
Though AirRadar doesn’t offer a channel graph like most stumblers, on the Statistics page they display a table for each Wi-Fi band listing the amount of networks and noise detected on each channel. They also list the least congested channels for each band.
The Map page shows the estimated locations of detected networks, which is gathered via the Apple location services.
From the AirRadar toolbar, you can save the network information for later viewing in the application and also export the data in a text format. In the Preferences, you can change various misc settings, including scanning interval, alerts, and color codes for different network types. Clicking the Help option from the toolbar brings up their online manual, which gives some useful info but could be better organized.
iStumbler
iStumbler isn’t just a Wi-Fi stumbler; it also detects Bluetooth and Bonjour devices, and provides detailed location stats. They provide an unlimited fully functional trial, with the only difference being a nag screen that currently pops up every 30 minutes, which the developer said may be changed to every 15 minutes. Purchasing a license removes the nag screen and costs $25 for all the computers you own.
Although the most current iStumbler build requires Mac OS X 10.10 or later, they still provide older builds for 10.2 and later. In all builds, only the internal AirPort adapter is supported; you can’t use a USB Wi-Fi adapter.
The iStumbler application has a tabbed-GUI. The main portion of the screen on the left changes based upon the tab you select (Wi-Fi, Bluetooth, Bonjour, Channels, or Location), which they refer to as Plugins.
The Wi-Fi tab is where you’ll find Wi-Fi stumbler along with most of the usual network details. Signal and noise levels are shown in negative dBm values and SNR levels are in dB values. Additionally, the SNR and signal levels are visually represented by a line graph and signal bars alongside the other details in the network’s row.
IStumbler is the only tool in this review that lacks filtering of the network list, which could be an inconvenience when dealing with more than a handful of networks. Additionally, the supported data rates of the networks aren’t given and it currently does not recognize when networks are using 80 or 160 MHz channel-widths, but the developers say the support will be added to the next maintenance release.
Selecting a network from the list allows you to see other details on the right portion of the screen: signal graph, network details in a table format, and a list of all the captures of the SSID along with signal and noise levels.
The Bluetooth tab shows any detected Bluetooth devices along with their details, which include the following: device name, MAC address, vendor, signal and SNR levels, and connection/pair status.
The Bonjour tab shows you a list of Bonjour-enabled computers and devices on the same network. You can browse through them and see a list of each Bonjour share or service. Clicking on them shows their details as well.
The Channels tab brings up a graph showing channel usage of the 2.4 and 5GHz bands over time. On the right portion of the screen you can see even further channel details, including a listing of all the channels, their frequency, and ratings.
The Location tab is supposed to list coordinates of where your computer and nearby Wi-Fi networks are estimated to be via Apple’s Location Services. You can then bring up the location information on several different online map platforms or export to Google Earth via a KML file. However, we found only the location information for our MacBook and the exporting button will crash the application. The developer says both will be fixed in the next maintenance release, and in the future they plan to utilize the GPS in your iOS device to provide more accurate location info.
In the Preferences, you can configure various settings for application and each Plugin. Accessing Help from the toolbar of iStumbler brings up their online manual, which we found useful, describing all the functions and settings.
KisMac2
KisMAC2 is a free and open source advanced Wi-Fi stumbler that also offers wireless injection and cracking features for penetration testing. It’s an active project that continues where the development of the original KisMac left off. It runs on Mac OS X 10.7 - 10.10, 64-bit only. In addition to the internal AirPort cards, it supports some USB Wi-Fi adapters that utilize specific wireless chipsets. It also supports remote capturing from Kismet servers and drones.
When you open KisMac2, you’ll see the Networks screen. Clicking the Start button begins the scanning. What is exactly shown depends upon if you have passive or active scanning chosen in the Preferences.
In active mode, you’ll see a list of SSIDs like most other stumblers for both 2.4 and 5GHz bands. In passive mode, you’ll see duplicate entries shown for some SSIDs as it also displays details from what looks like probe packets. Further network details are also collected, however the 5GHz band was not scanned while in passive mode.
Signal levels seem to be given in a unique numbering system with a current, average, and max value. It’s not a negative dBm value nor a percentage as we saw the number for one close access point go up to 155. We weren’t able to contact the developer directly to get an answer either, but we could still use the numbers to compare against the other access points. However, we also noticed no signal levels are given at all for 5GHz, and for either band there’s no noise or SNR levels.
We weren’t able to get hidden SSIDs to show up on the network list, but we were only using the internal AirPort card. It looks like KisMAC2 will show and reveal hidden SSIDs when using other drivers.
Clicking a network takes you to its Details page, with the exact details dependent upon which scanning mode you’re using. In active mode, basic details are shown and in passive mode you’ll find additional details shown, such as the supported data rates, packet counts, and list and details of clients connected to the SSID.
On the Graph screen of KisMAC you can view a graph of the signal levels, packet counts, or bytes of each SSID. There’s no channel usage graph provided, however.
The Map screen looks like it’s supposed to show the location of access points on a map, but we couldn’t seem to zoom in enough to see what’s actually displayed and unsure of it’s usefulness. However, it looks like you could log GPS location coordinates and export to Google Earth for a more user-friendly view.
From the KisMAC2 toolbar, you can save and export the collected data and maps in various formats for later viewing. In the Preferences, you can configure various scanning, filtering, driver, GPS, map, and traffic settings. Though there are shortcuts in the Help menu of the toolbar, most don’t work as they point to the original KisMAC website that is currently not working. One link does point to the current project’s GitHub page but doesn’t include any good help or documentation.
NetSpot
NetSpot is a Wi-Fi stumbler and map-based surveying tool developed and distributed by Etwok, LLC. It’s supported on Mac OS X 10.6 and later and offered in three different editions. The free edition offers basic Wi-Fi stumbler functionality and basic map-based surveying.
The PRO edition ($149) adds active scanning with speed testing and exporting of the network list to the stumbler feature. For the surveying portion of NetSpot, the PRO edition adds the ability to survey secured and hidden networks, additional visualizations, auto saving, and supports up to 50 data collection zones and 50 snapshots per zone. The Enterprise edition ($499) supports up to 10 users, or unlimited users for a custom price. It doesn’t add additional features, but does allow unlimited data collection zones and snapshots.
When you open NetSpot, you have two options on the top: click Discover for the Wi-Fi stumbler to see the details of nearby networks or click Survey to do a map-based survey.
On the Discover screen, you’ll see all the typical details besides supported data rates. The signal and noise levels are given in both negative dBm and percentages.
You can double-click a network for graphs and more details. On the pop-up window, first is the Signal & Noise tab showing the levels for each network with the currently selected network highlighted. The next tab, named Tabular Data, gives you a time-stamped list of all the signal and noise snapshots or captures for the currently selected network. The remaining two tabs show channel usage graphs, one for each Wi-Fi band.
On the top of the Discover screen, you’ll see an Export button, but remember the free edition doesn’t support exporting the network list. The User Guide button (which also appears on the Survey screen) brings up the same website as when you access Help from the toolbar. It contains a lot of useful information, but is in a FAQ format rather than a traditional manual or user guide format.
On the bottom of the Discover screen, you can toggle scanning on and off, adjust scanning interval, and click the Details button as an alternative to double-clicking a network to bring up the graphs and additional details. On the bottom right, you can also type in a search phrase to filter the list of networks.
On the Survey screen of NetSpot you can perform map-based surveys in order to generate heatmaps to visualize signal coverage and other parameters on a floor map of your choice. Keep in mind, the free edition has many limitations, including only capturing open or unsecured networks, surveying one zone or floor plan per project, and only two visualizations are given at the end.
Setting up a survey is straightforward. You select a floor plan map, set calibration, configure which networks to capture, and set scanning type. Like most other surveying programs, you walk around the area to be surveyed while clicking where you are on the map.
Once you’re done, you can select which SSIDs to include in the visualizations from the list on the left. On the bottom you see the color-coded legend and can select other visualizations to view on the map. In the free edition, you only have the signal and SNR visualizations.
In the PRO edition, you have many more visualizations to choose from: quality of access points, noise level, signal-to-interference ratio, frequency band coverage, PHY mode coverage, and troubleshooting. The PRO edition also adds visualizations for a couple of different download and upload speeds, if active scanning was selected.
On the top of the Survey screen, you see the same buttons on the top. The Export button allows PRO or Enterprise users to generate reports and heatmap images.
From the Survey menu on the NetSpot toolbar, you save your survey project and manage other project and zone settings, which are mostly available only in the PRO or Enterprise editions, though the Free edition does allow basic saving of the survey project. From the NetSpot toolbar you can also access the Preferences of the application, which includes various settings for the discover and survey functions.
WiFi Explorer
WiFi Explorer is a general Wi-Fi stumbler developed by Adrian Granados, available for $6.99 via the App Store. It runs on Mac OS X 10.7 and later. It only works with the internal AirPort card; USB Wi-Fi adapters aren’t supported.
Once you open WiFi Explorer, you immediately see the list of SSIDs on an attractive GUI. You’ll see the usual network details, including noise and SNR, and can add/remove more details via right-clicking on the columns. By default, the signal levels are shown in percentages, but you can change to dBm via the Preferences.
Selecting a network from the list will show further details, including a graph for that particular SSID, on the bottom portion of the screen. You can toggle between signal, signal and noise, and SNR for the graph. All graph options include a small convenient secondary graph on the right showing the levels on other access points operating on the same channel, if there are any.
On the bottom portion of the screen, you can also tab through additional screens. The Signal Strength tab shows a graph of the signals from all access points. The Channels tab shows a channel graph of both frequency bands. The Advanced Details tab shows additional details on the network currently selected from the list above. This includes supported rates, HT capabilities and operation, and other advanced details.
On the left portion of the main screen, you can utilize their pre-configured filters. For instance, you can choose to view only access points with a particular SSID, those using a certain 802.11 standard, SSIDs from a particular radio, SSIDs from access points using a certain vendor, or SSIDs that are within a defined signal range.
On the top of the screen you can also filter based upon open, secure, or ad-hoc networks. You can also type into the text field to quickly filter upon a desired SSID name. Additionally, on the top of the screen you can toggle scanning on and off, and see the connection details for the AirPort card.
From the toolbar, you can access the application Preferences, which include scanning settings, columns to be displayed, and advanced settings. From the File menu, you can open, save, and export the network details. Accessing the Help brings up a traditional help window, containing great documentation, which is also accessible offline. It includes some good general Wi-Fi troubleshooting information as well.
WiFi Scanner
WiFi Scanner is a general Wi-Fi stumbler with network scanning capabilities as well, available from the Apple App Store for $6.99. It is developed by AccessAgility, which also offers a cloud-based Wi-Fi monitoring solution and is working on a desktop version of their scanner for Windows too. Currently, their WiFi Scanner application runs on Mac OS X 10.6 and later, but for all features you must have 10.7 or later.
When you open WiFi Scanner, you’ll see the network list and all their details right away on the main screen. It includes all the usual SSID and network details, with signal and noise levels shown in dBm values.
On the bottom portion of the main screen, you can tab between different pages of information. First is the SSID Details tab, showing the same details from the list along with a couple more and a signal/noise graph with SNR reading as well.
The RSSI vs. Time tab shows a signal graph of all SSIDs, with the selected network conveniently highlighted. The 2.4 and 5 GHz tabs show channel graphs of their respective band. The Signal Rank tab shows a bar chart of the SSID signals from best to worse. The Speed Test tab allows you to run download and upload bandwidth tests on the network you’re currently connected to and then tracks the results on a graph.
On the top portion of the main screen, you find some scanning and filtering settings. You can optionally stop scanning and then restart to capture multiple scanning sessions that you can switch between from the left portion of the screen, which keeps a running list of the sessions.
On the very top of the screen, you find two other main tabs. The Connected SSID tab shows you basically the same information as the SSID Details sub-tab, but shows additional security details and a larger graph. The Who’s On My Network tab, you can perform IP scanning to see the list of devices and IP addresses detected on the network you’re currently connected to. You can then click a device to name it and give it an icon and also view it’s Media Access Control address, hostname, vendor, and last and first seen date/time.
From the WiFi Scanner toolbar, you can access the Preferences. From there you can customize the details shown on the network list and graphs, customize speed test settings, define the IP address range for the IP scanner, and configure a remote GPS connection.
On the File menu of the toolbar you’ll see several exporting and reporting options to save your results in CSV or HTML files, optionally with the graph images as well. However, keep in mind you can’t save the data and re-open with the WiFi Scanner application. The Help shortcut brings up thorough and useful documentation, but it’s not available offline, though you can download from their website.