Connecting to your RUCKUS APs

ARRF surveys by logging into each of your RUCKUS access points and reading the AP-measured signal live. This page covers the manual connection path — fixed AP IPs on your LAN. If your APs are managed in RUCKUS One, see Setting up a RUCKUS One account instead, which imports the APs and fetches their passwords for you.

How ARRF talks to APs

Surveys poll each AP’s rkscli command line over SSH (TCP 22), reading the AP-measured signal about 2.5 times a second. This is the only transport — there is no SNMP or agent to install. The AP login user is always admin; only the password varies.

Same network

Your iPhone must be on the same local network as the APs, and reachable to them over SSH. If a management ACL or firewall restricts which hosts can SSH to your APs, the test iPhone needs to be permitted.

Add your APs

1. Open Settings → Connection → APs.

2. Tap Add AP and enter each AP’s IPv4 address (for example 192.0.2.11). Invalid addresses show in red. The screen asks for 2 to 5 AP IPs, and 5 is a hard ceiling. A single-AP list is accepted and surveys normally — you simply can’t record a roam, because there is nowhere to roam to.

3. Enter each AP’s admin password in the AP passwords (SSH) section below the list, which shows one secure field per valid AP IP.

Passwords are stored per AP in the iOS Keychain — never in plain settings, and never sent anywhere off the device.

If you start a manual survey with no password saved for any of your APs, the lobby warns you before you walk: “No saved AP passwords — Live will fail to log in. Save them in Settings ▸ Connection ▸ APs, or pick a RUCKUS One venue.” The pre-flight probe only tests whether port 22 answers, so it can pass while every login still fails.

Manual passwords go stale on R1-managed APs

RUCKUS One venues fetch passwords automatically, because R1-managed AP passwords rotate roughly every two days — a manually saved password on an R1-managed AP goes stale on that cycle. See RUCKUS One account.

A manual password is not only for manual surveys, though: it is also the last fallback when a venue survey can’t fetch one. ARRF resolves an AP’s login in this order — an unexpired fetched credential, then a fresh fetch from RUCKUS One, then a manual password saved for that AP’s IP. Saving one by hand is a reasonable belt-and-braces move for an AP you survey often.

Set the target SSID

The Target SSID is the WLAN ARRF polls on each AP. Set it in Settings → Connection → Target SSID, or let ARRF list what your APs actually broadcast: the SSID picker scans each configured AP and shows every broadcast SSID — tap the WLAN you’re surveying and it’s written to Target SSID (still editable by hand). If no AP is broadcasting the target SSID, that AP reports “no up WLAN broadcasting” during the survey.

Host-key trust and Trusted APs

The first time ARRF connects to an AP, it pins that AP’s SSH host key (trust-on-first-use) and stores the SHA-256 fingerprint on the device. You are not prompted — the first sighting is trusted silently.

On later connections, if the AP presents a different host key, ARRF refuses the connection and reports that the host key changed. It does not offer to trust the new key inline, because a changed key can mean a man-in-the-middle.

In words: an AP starts unpinned; the first connection records its fingerprint without asking; every later connection that presents the same key proceeds; a different key is refused outright; and the only way back is to forget the pin, which returns that AP to the unpinned state so the next connection trusts and re-pins whatever key it now presents.

Forget a pinned AP

Settings → Connection → Trusted APs lists every AP ARRF has pinned, each with its IP and SHA256: fingerprint. Swipe a row and tap Forget to drop that pin.

Forget only when you know why the key changed

Forgetting a pin is the recovery path for an AP you replaced or factory-reset — its identity legitimately changed. If you weren’t expecting the change, a mismatch can indicate a man-in-the-middle: confirm the hardware on that IP before you forget anything.

The screen reads “No trusted APs yet” until the first successful connection. Pins are per-IP and local to this iPhone.

Start a manual survey

In the Survey lobby’s Where picker, choose Manual. When you tap Start Survey, ARRF runs a quick pre-flight — a bare SSH-port probe of each AP — and tells you which APs answered before the walk begins. See Running a survey.

Next steps

Running a survey Pre-flight, capture modes, the AR HUD, and what Stop saves.

Setting up a RUCKUS One account The alternative to maintaining AP IPs and passwords by hand.

Settings reference Every Connection field, including Trusted APs, with its real default.

Troubleshooting Unreachable APs, rejected rkscli logins, and changed host keys.