Connecting to your RUCKUS APs

With the optional, free RUCKUS pack, ARRF surveys by logging into each of your RUCKUS access points and reading the AP-measured signal live. You don’t need any of this for an Any Wi-Fi survey, which measures from the phone alone. This page covers the manual connection path — APs you enter by hand, at fixed addresses on your LAN, shown in the Survey lobby as RUCKUS APs by IP. If your APs are managed in RUCKUS One, see Setting up a RUCKUS One account instead, which imports the APs and fetches their passwords for you.

How ARRF talks to APs

Surveys poll each AP’s rkscli command line over SSH (TCP 22), reading the AP-measured signal about 2.5 times a second. This is the only transport — there is no SNMP or agent to install. RUCKUS One venues always log in as admin; for manually added APs the username defaults to admin and can be changed (one username for all of them).

Same network

Your iPhone must be on the same local network as the APs, and reachable to them over SSH. If a management ACL or firewall restricts which hosts can SSH to your APs, the test iPhone needs to be permitted.

Add your APs

1. Open Settings → Integrations → RUCKUS → APs. (The Survey lobby’s Add APs by IP button opens the same screen.)

2. Tap Add AP and enter each AP’s address — an IPv4 address (for example 192.0.2.11), an IPv6 address, or a hostname. Invalid addresses show in red with an Invalid label. The list holds up to 6 APs, the same cap as a venue survey. A single-AP list is accepted and surveys normally — you simply can’t record a roam, because there is nowhere to roam to.

3. Enter each AP’s password in the AP passwords (SSH) section below the list, which shows a Username field (blank means admin) and one secure field per valid AP address.

Passwords are stored per AP in the iOS Keychain — never in plain settings, and never sent anywhere off the device.

If you start a manual survey with no password saved for any of your APs, the lobby warns you before you walk: “No saved AP passwords — the SSH login will fail. Save them in Settings ▸ Integrations ▸ RUCKUS ▸ APs, or pick a RUCKUS One venue.” The pre-flight probe only tests whether port 22 answers, so it can pass while every login still fails.

Manual passwords go stale on R1-managed APs

RUCKUS One venues fetch passwords automatically, because R1-managed AP passwords rotate roughly every two days — a manually saved password on an R1-managed AP goes stale on that cycle. See RUCKUS One account.

A manual password is not only for manual surveys, though: it is also the last fallback when a venue survey can’t fetch one. ARRF resolves an AP’s login in this order — an unexpired fetched credential, then a fresh fetch from RUCKUS One, then a manual password saved for that AP’s IP. Saving one by hand is a reasonable belt-and-braces move for an AP you survey often.

Set the target SSID

The Target SSID is the WLAN ARRF polls on each AP, and Start stays disabled until one is set (“Choose the SSID to survey”). The easiest way is the lobby’s Choose SSID row: it reads each configured AP’s broadcast WLANs over SSH and lists every broadcast SSID — tap the WLAN you’re surveying and it’s written to Target SSID. You can also type it by hand under Settings → Integrations → RUCKUS → Target SSID. If no AP is broadcasting the target SSID, that AP reports “no up WLAN broadcasting” during the survey.

Pick your phone

A RUCKUS survey reads the signal the APs hear from one Wi-Fi client, so ARRF needs this iPhone’s Wi-Fi MAC address. Until one is set, Start stays disabled and the lobby reads “Pick your phone so the APs know whose signal to read”. Tap Identify my phone to pick it from the APs’ client list — see Identify My Phone.

Host-key trust and Trusted APs

The first time ARRF connects to an AP, it pins that AP’s SSH host key (trust-on-first-use) and stores the SHA-256 fingerprint on the device. You are not prompted — the first sighting is trusted silently.

On later connections, if the AP presents a different host key, ARRF refuses the connection and reports “This AP’s SSH identity changed (…) — if it was replaced or reset, review it in Settings ▸ Integrations ▸ RUCKUS ▸ Trusted APs.” It does not offer to trust the new key inline, because a changed key can mean a man-in-the-middle.

In words: an AP starts unpinned; the first connection records its fingerprint without asking; every later connection that presents the same key proceeds; a different key is refused outright; and the only way back is to forget the pin, which returns that AP to the unpinned state so the next connection trusts and re-pins whatever key it now presents.

Forget a pinned AP

Settings → Integrations → RUCKUS → Trusted APs lists every AP ARRF has pinned, each with its IP and SHA256: fingerprint. Swipe a row and tap Forget to drop that pin.

Forget only when you know why the key changed

Forgetting a pin is the recovery path for an AP you replaced or factory-reset — its identity legitimately changed. If you weren’t expecting the change, a mismatch can indicate a man-in-the-middle: confirm the hardware on that IP before you forget anything.

The screen reads “No trusted APs yet” until the first successful connection. Pins are per-IP and local to this iPhone.

Start a manual survey

Tap the Survey lobby’s Where card and choose RUCKUS APs by IP. When you tap Start Survey, ARRF runs a quick pre-flight — a bare SSH-port probe of each AP. If every AP answers, the survey starts straight away; if some don’t, a sheet lists which answered and, when at least one did, offers Start anyway (offline APs are skipped). Real surveys need the free trial or the unlock. See Running a survey.

Next steps

Running a survey Pre-flight, capture modes, the AR HUD, and what Stop saves.

Setting up a RUCKUS One account The alternative to maintaining AP IPs and passwords by hand.

Settings reference Every Connection field, including Trusted APs, with its real default.

Troubleshooting Unreachable APs, rejected rkscli logins, and changed host keys.