Packet capture

Packet capture records raw 802.11 frames on one AP radio for a few seconds, pulls the pcap back to the iPhone over TFTP, and analyses it on the device. It is the deepest tool in the Toolbox — and the only one that changes anything on the access point.

This one is not read-only

Packet capture puts the chosen radio into capture mode for the window you set, then returns it to idle. Nothing is written to the AP’s configuration and the radio is always released — on success, on failure, and if you leave the screen — but a live radio is briefly in a different mode, so pick your moment on a production AP.

What happens, step by step

In words: ARRF opens a TFTP receiver on the iPhone, connects to the AP over SSH, reads the radio’s channel for context, idles the radio to start from a clean state, begins the capture, counts down your window, stops the capture, and asks the AP to TFTP the file back. The pcap is analysed entirely on the phone. The radio is idled again on the way out, and again on any error path, so a failed capture never leaves a radio capturing.

Run a capture

1. Open Toolbox → Packet capture and pick the AP (you go straight in if only one AP is connected).

2. Choose the radio — listed as wifi0 · 2.4 GHz, wifi1 · 5 GHz, and wifi2 · 6 GHz. The default is wifi1.

3. Set the window with the stepper: 3 to 30 seconds, default 10.

4. Narrow it with filters if you want to (below), then start the capture and wait out the countdown.

The screen walks through capturing → “Transferring pcap over TFTP…” → “Analysing N bytes…” → results.

“You’re on this radio”

If your iPhone is associated to the AP you’re capturing on, and on the band you picked, ARRF warns you before you start. Capturing that radio taps the same radio that has to carry the pcap back, so the transfer can stall or fail. Capture a different band, or capture that band from another AP.

Filters

All filters default to off, so an unfiltered capture records everything and the analysis is complete. Narrow from there:

Filter	Effect
Exclude beacons	Drops beacon frames, which otherwise dominate the air.
Exclude management	Drops management frames.
Exclude control	Drops control frames.
Exclude data	Drops data frames.
This radio’s BSS only	Restricts the capture to the radio’s own BSS instead of everything it can hear.
Only client (MAC)	Captures one client’s frames only.

Only client (MAC) is pre-filled with this iPhone’s own address so the default run is “capture just my traffic”. Clear the field to capture everything; once you type your own MAC, ARRF stops overwriting it.

What the analysis shows

The results are computed on the device from the pcap itself:

• A frame-type breakdown — counts per management, control, and data subtype. deauth and disassoc are highlighted in red when non-zero, because they are the usual cause of a client being kicked.
• Data retry rate — retried data frames over total data frames, the single best indicator of a struggling link.
• The raw pcap, shareable to Files, AirDrop, or any capture analyser you prefer.

One radio, one channel, one window

The summary describes what that AP’s radio heard on its own channel for those few seconds. It is not a per-location measurement and it is not a whole-band view — for spatial data, run a survey.

Requirements and failure modes

• Local Network permission, because the pcap arrives at the iPhone over TFTP on UDP 69. If ARRF can’t bind that port you’ll see “Couldn’t open the local capture receiver on UDP 69.”
• The AP must be able to reach the iPhone, not just the other way round — the AP initiates the TFTP transfer to your phone’s IP. A firewall or client-isolation rule between AP and phone breaks the return path even though SSH worked.
• If no data arrives, ARRF reports “The AP didn’t deliver the capture (no TFTP data arrived)”, or the last meaningful line of the AP’s own error, and releases the radio.

Next steps

Toolbox utilities The other nine tools, all of which only read.

Connecting to your RUCKUS APs The SSH connection and credentials every Toolbox tool uses.

Troubleshooting Unreachable APs, rejected logins, and captures that never arrive.