Wi-Spy Spectrum Analyzer

I've been playing with a Wi-Spy Spectrum Analyzer for a few hours.
http://www.metageek.net
$99 plus shipping. I installed it on my Panasonic M34 laptop running
W2K and did some really crude testing. Some initial comments:

1. It's fairly fast which is a BIG plus. It's much faster and better
than my Proxim 7400 card. I set my access point to beacon once every
second instead of the usual 10 times per second. It was easily
detected but took a few sweeps for wi-spy to coincidentally end up on
the same exact frequency as the access point. One can't see the
sinx/x DSSS spectra, but it's close enough.

2. It can easily pickup my Panasonic KX-TG2257 2.4GHz cordless phone
and microwave oven from anywhere in the house (2 floors). Sensitivity,
even with the tiny antenna, is quite impressive.

3. Dynamic range sucks but that's understandable. The noise floor is
about -60dBm while the SA saturates at about -32dBm. That's 28dB of
dynamic range which is really bad compared to my ancient HP140T
spectrum analyzer with about 60dB of dynamic range. However, I would
not expect much more from such a unit. What this means is that there
will need to be some form of attenuator to deal with close in
sniffing, and possibly an adjustable gain amplifier for long range
work.

I can just barely see my neighbors client radio at about 200ft with a
2dBi antenna and a tangle of wet trees in between. I'm sure that with
an external antenna on the wi-spy, it would be detectable.

I had my neighbor across the street (about 50ft) fire up their Uniden
something 2.4GHz cordless phone. I could see it, but just barely.
Again, more antenna gain would be helpful.

4. The software appears to be stable and quite useful. Whomever
wrote it apparently has used commercial spectrum analyzers. I had
some problems restarting the application after hibernation, but a
reboot solved that. I can run my Netgear WG511v2 PCMCIA card at the
same time. It makes for an interesting display, especially when the
card is scanning for access points.

5. I won't post any AVI recording files until I get a reproducible
setup and possibly butcher the unit with a better antenna. The ones
on the web site should be sufficient for now.
| http://recordings.metageek.net/index.php

6. The display is either by channel number or by frequency. It will
display all 14 UK channels, but when set to frequency, it reverts to
the 11 US channels (2400 to 2483.5).

7. I couldn't resist taking it apart and analyzing the hardware. It's
actually a DSSS wireless mouse receiver. The radio module is made by
Unigen:
| http://www.unigen.com/product05/W_JU...mber=UGQUBE1US
I had to apply for permission to download their secret data sheet.
Maybe later.

Photos at:
| http://802.11junk.com/jeffl/pics/wir...Spy/index.html
The square thing in the picture is a push button, usually used to
synchronize a wireless mouse with a USB adapter. The RF chips is a
Cypress Semi CYWUSB6934-48LFXC:
| http://www.cypress.com/portal/server...rpn=CYWUSB6934

The antenna is the wiggly affair on the right of:
| http://802.11junk.com/jeffl/pics/wir...Wi-Spy-01.html
It appears that I can easily attach a small coax pigtail for an
external antenna. Of course, the usual coffee can or dish reflector
can also be used. Some notes on the antenna design:
| http://www.cypress.com/portal/server...__an5032_9.pdf

Bottom line is that it works and seems to work well enough. It will
need some modifications to attach an external antenna in order to make
it suitable for interference detection and location. It may take a
while for me to use it in the field (it's raining). However, the fact
that it can easily detect my leaky microwave oven and 2.4Ghz cordless
phone means that it is sure to be useful.

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

Jeff Liebermann wrote:
> I've been playing with a Wi-Spy Spectrum Analyzer for a few hours.
> http://www.metageek.net
> $99 plus shipping. I installed it on my Panasonic M34 laptop running
> W2K and did some really crude testing. Some initial comments:
>
> 1. It's fairly fast which is a BIG plus. It's much faster and better
> than my Proxim 7400 card. I set my access point to beacon once every
> second instead of the usual 10 times per second. It was easily
> detected but took a few sweeps for wi-spy to coincidentally end up on
> the same exact frequency as the access point. One can't see the
> sinx/x DSSS spectra, but it's close enough.
>
> 2. It can easily pickup my Panasonic KX-TG2257 2.4GHz cordless phone
> and microwave oven from anywhere in the house (2 floors). Sensitivity,
> even with the tiny antenna, is quite impressive.
>
> 3. Dynamic range sucks but that's understandable. The noise floor is
> about -60dBm while the SA saturates at about -32dBm. That's 28dB of
> dynamic range which is really bad compared to my ancient HP140T
> spectrum analyzer with about 60dB of dynamic range. However, I would
> not expect much more from such a unit. What this means is that there
> will need to be some form of attenuator to deal with close in
> sniffing, and possibly an adjustable gain amplifier for long range
> work.
>
> I can just barely see my neighbors client radio at about 200ft with a
> 2dBi antenna and a tangle of wet trees in between. I'm sure that with
> an external antenna on the wi-spy, it would be detectable.
>
> I had my neighbor across the street (about 50ft) fire up their Uniden
> something 2.4GHz cordless phone. I could see it, but just barely.
> Again, more antenna gain would be helpful.
>
> 4. The software appears to be stable and quite useful. Whomever
> wrote it apparently has used commercial spectrum analyzers. I had
> some problems restarting the application after hibernation, but a
> reboot solved that. I can run my Netgear WG511v2 PCMCIA card at the
> same time. It makes for an interesting display, especially when the
> card is scanning for access points.
>
> 5. I won't post any AVI recording files until I get a reproducible
> setup and possibly butcher the unit with a better antenna. The ones
> on the web site should be sufficient for now.
> | http://recordings.metageek.net/index.php
>
> 6. The display is either by channel number or by frequency. It will
> display all 14 UK channels, but when set to frequency, it reverts to
> the 11 US channels (2400 to 2483.5).
>
> 7. I couldn't resist taking it apart and analyzing the hardware. It's
> actually a DSSS wireless mouse receiver. The radio module is made by
> Unigen:
> | http://www.unigen.com/product05/W_JU...mber=UGQUBE1US
> I had to apply for permission to download their secret data sheet.
> Maybe later.
>
> Photos at:
> | http://802.11junk.com/jeffl/pics/wir...Spy/index.html
> The square thing in the picture is a push button, usually used to
> synchronize a wireless mouse with a USB adapter. The RF chips is a
> Cypress Semi CYWUSB6934-48LFXC:
> | http://www.cypress.com/portal/server...rpn=CYWUSB6934
>
> The antenna is the wiggly affair on the right of:
> | http://802.11junk.com/jeffl/pics/wir...Wi-Spy-01.html
> It appears that I can easily attach a small coax pigtail for an
> external antenna. Of course, the usual coffee can or dish reflector
> can also be used. Some notes on the antenna design:
> | http://www.cypress.com/portal/server...__an5032_9.pdf
>
> Bottom line is that it works and seems to work well enough. It will
> need some modifications to attach an external antenna in order to make
> it suitable for interference detection and location. It may take a
> while for me to use it in the field (it's raining). However, the fact
> that it can easily detect my leaky microwave oven and 2.4Ghz cordless
> phone means that it is sure to be useful.

Jeff, you're a gentleman and a scholar, I don't care what everybody else
says. A $100 SA would be great if it works. Will stay tuned to see what
else develops.

Jeff Liebermann wrote:
> I've been playing with a Wi-Spy Spectrum Analyzer for a few hours.
> http://www.metageek.net
> $99 plus shipping. I installed it on my Panasonic M34 laptop running
> W2K and did some really crude testing. Some initial comments:
>
> 1. It's fairly fast which is a BIG plus. It's much faster and better
> than my Proxim 7400 card. I set my access point to beacon once every
> second instead of the usual 10 times per second. It was easily
> detected but took a few sweeps for wi-spy to coincidentally end up on
> the same exact frequency as the access point. One can't see the
> sinx/x DSSS spectra, but it's close enough.
>
> 2. It can easily pickup my Panasonic KX-TG2257 2.4GHz cordless phone
> and microwave oven from anywhere in the house (2 floors). Sensitivity,
> even with the tiny antenna, is quite impressive.
>
> 3. Dynamic range sucks but that's understandable. The noise floor is
> about -60dBm while the SA saturates at about -32dBm. That's 28dB of
> dynamic range which is really bad compared to my ancient HP140T
> spectrum analyzer with about 60dB of dynamic range. However, I would
> not expect much more from such a unit. What this means is that there
> will need to be some form of attenuator to deal with close in
> sniffing, and possibly an adjustable gain amplifier for long range
> work.
>
> I can just barely see my neighbors client radio at about 200ft with a
> 2dBi antenna and a tangle of wet trees in between. I'm sure that with
> an external antenna on the wi-spy, it would be detectable.
>
> I had my neighbor across the street (about 50ft) fire up their Uniden
> something 2.4GHz cordless phone. I could see it, but just barely.
> Again, more antenna gain would be helpful.
>
> 4. The software appears to be stable and quite useful. Whomever
> wrote it apparently has used commercial spectrum analyzers. I had
> some problems restarting the application after hibernation, but a
> reboot solved that. I can run my Netgear WG511v2 PCMCIA card at the
> same time. It makes for an interesting display, especially when the
> card is scanning for access points.
>
> 5. I won't post any AVI recording files until I get a reproducible
> setup and possibly butcher the unit with a better antenna. The ones
> on the web site should be sufficient for now.
> | http://recordings.metageek.net/index.php
>
> 6. The display is either by channel number or by frequency. It will
> display all 14 UK channels, but when set to frequency, it reverts to
> the 11 US channels (2400 to 2483.5).
>
> 7. I couldn't resist taking it apart and analyzing the hardware. It's
> actually a DSSS wireless mouse receiver. The radio module is made by
> Unigen:
> | http://www.unigen.com/product05/W_JU...mber=UGQUBE1US
> I had to apply for permission to download their secret data sheet.
> Maybe later.
>
> Photos at:
> | http://802.11junk.com/jeffl/pics/wir...Spy/index.html
> The square thing in the picture is a push button, usually used to
> synchronize a wireless mouse with a USB adapter. The RF chips is a
> Cypress Semi CYWUSB6934-48LFXC:
> | http://www.cypress.com/portal/server...rpn=CYWUSB6934
>
> The antenna is the wiggly affair on the right of:
> | http://802.11junk.com/jeffl/pics/wir...Wi-Spy-01.html
> It appears that I can easily attach a small coax pigtail for an
> external antenna. Of course, the usual coffee can or dish reflector
> can also be used. Some notes on the antenna design:
> | http://www.cypress.com/portal/server...__an5032_9.pdf
>
> Bottom line is that it works and seems to work well enough. It will
> need some modifications to attach an external antenna in order to make
> it suitable for interference detection and location. It may take a
> while for me to use it in the field (it's raining). However, the fact
> that it can easily detect my leaky microwave oven and 2.4Ghz cordless
> phone means that it is sure to be useful.
>
Thanks for the update.
Noticed this is in their forum ,so will watch with interest.
http://www.metageek.net/forum/viewto...a1d780e30a0d95
Spastic, I like this idea! Currently the average trace shows the average
over all time or since the last time history was cleared. Your idea to
scale the average in relation to the noisiest channel is good; another
idea we have played with is just average the past 1-2 minutes of
traffic. We will do further investigations into making the average trace
more useful and will post a development build of version 1.1 sometime
next week.

Jeff Liebermann <(E-Mail Removed)> wrote:
>I've been playing with a Wi-Spy Spectrum Analyzer for a few hours.
> http://www.metageek.net

Thanks, Jeff, gotta get one on order!

On Sun, 01 Jan 2006, in the Usenet newsgroup alt.internet.wireless, in article
<(E-Mail Removed)>, Jeff Liebermann wrote:

>$99 plus shipping.

>3. Dynamic range sucks but that's understandable. The noise floor is
>about -60dBm while the SA saturates at about -32dBm.

Either that's a pretty wide bandwidth, or it's awfully noisy. Saturating
at -32 sounds as if it's got something active in front of what ever is
saturating. However, -32 out of a 3 dBi antenna isn't especially a weak
signal in space.

>That's 28dB of dynamic range which is really bad

I'll say

>compared to my ancient HP140T spectrum analyzer with about 60dB of
>dynamic range.

But then, a hundred bucks isn't going to pay for the power cord on
that HP, and depending on the plug-in, the HP has a heck of a lot
more scan width. Back when Marconi was still playing with spark gaps
or something, I think we paid US$12k for the 8555 (10 KHz - 12.4 GHz).

>However, I would not expect much more from such a unit. What this means
>is that there will need to be some form of attenuator to deal with close
>in sniffing, and possibly an adjustable gain amplifier for long range
>work.

Mini Circuits Lab used to make a nice low noise preamp - problem is the
onezy cost is probably more than you paid for the Wi-Spy.

>It may take a while for me to use it in the field (it's raining).

As long as the Mighty San Lorenzo is staying within it's banks (you guys
are hogging all the precip - we got a 10% chance tonight, which would be
the first rain since early November).

Old guy

(E-Mail Removed) (Moe Trin) hath wroth:

>>3. Dynamic range sucks but that's understandable. The noise floor is
>>about -60dBm while the SA saturates at about -32dBm.

>Either that's a pretty wide bandwidth, or it's awfully noisy. Saturating
>at -32 sounds as if it's got something active in front of what ever is
>saturating. However, -32 out of a 3 dBi antenna isn't especially a weak
>signal in space.

I've been reading the data sheet on the chip at:
| http://www.cypress.com/portal/server...wusb6934_5.pdf
The channels are 1MHz wide. In theory, the receiver sensitivity is
-90dBm while the overload point (on pg 27) is -10dBm (typ). That
should yield a theoretical 80dB dynamic range. However, the RSSI
indicator starts at -95dBm with 1-10 units and saturates at -40dBm
with 28 to 31 units. That's only 55dB at best (probably less). With
a 1MHz receiver, the base line noise level is probably about -85dBm
(my guess) yielding only 45dB of dynamic range. Since I based my
guess(tm) of dynamic range on the Wi-Spy signal level readings, which
may or may not be accurate, the dynamic range may actually be larger.
When I stick an antenna on the radio, and do some real measuring, I'll
be able to measure the dynamic range.

>>That's 28dB of dynamic range which is really bad
>
>I'll say

Reminder. That was from the on-screen calibration markings, which
might be wrong.

>>compared to my ancient HP140T spectrum analyzer with about 60dB of
>>dynamic range.
>
>But then, a hundred bucks isn't going to pay for the power cord on
>that HP, and depending on the plug-in, the HP has a heck of a lot
>more scan width. Back when Marconi was still playing with spark gaps
>or something, I think we paid US$12k for the 8555 (10 KHz - 12.4 GHz).

The 1977 HP test equipment catalog prices the 8555 front end for
$7700. Add $1475 for the 140T main frame and $3775 for the hi res IF
section. That's what I use for a spectrum analyzer. However, I
borrowed the 8555A RF section and am looking for a replacment.
http://802.11junk.com/jeffl/pics/hom.../BL-shop2.html
Hmmm... There's a complete 141T on eBay for $680 total. Tempting.
http://cgi.ebay.com/ws/eBayISAPI.dll...tem=7576320299

>Mini Circuits Lab used to make a nice low noise preamp - problem is the
>onezy cost is probably more than you paid for the Wi-Spy.

Those were MMIC's and had a lousy noise figure. I make my own using a
GaAs xsistor. However, if I can mount the radio very close to the
antenna, it probably won't do much good.

>>It may take a while for me to use it in the field (it's raining).
>
>As long as the Mighty San Lorenzo is staying within it's banks (you guys
>are hogging all the precip - we got a 10% chance tonight, which would be
>the first rain since early November).

San Lorenzo River levels:
http://waterdata.usgs.gov/ca/nwis/uv/?site_no=11160500
http://waterdata.usgs.gov/ca/nwis/uv/?site_no=11161000
My palatial office is right next to the levee in Santa Cruz. Glug...

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

Jeff Liebermann <(E-Mail Removed)> wrote:
>| http://802.11junk.com/jeffl/pics/wir...Spy/index.html
>The square thing in the picture is a push button, usually used to
>synchronize a wireless mouse with a USB adapter.

Does it have any function in the Wi-Spy, or are they just putting
their own cover over someone else's USB device? [Mine's on order!]

William P.N. Smith wrote:
> Jeff Liebermann <(E-Mail Removed)> wrote:
>
>>| http://802.11junk.com/jeffl/pics/wir...Spy/index.html
>>The square thing in the picture is a push button, usually used to
>>synchronize a wireless mouse with a USB adapter.
>
>
> Does it have any function in the Wi-Spy, or are they just putting
> their own cover over someone else's USB device? [Mine's on order!]

FCC ID R8KUGQUBE1US
Not much info yet.

William P.N. Smith <(E-Mail Removed)> hath wroth:

>Jeff Liebermann <(E-Mail Removed)> wrote:
>>| http://802.11junk.com/jeffl/pics/wir...Spy/index.html
>>The square thing in the picture is a push button, usually used to
>>synchronize a wireless mouse with a USB adapter.

>Does it have any function in the Wi-Spy, or are they just putting
>their own cover over someone else's USB device? [Mine's on order!]

The switch apparently doesn't do anything. There's no hole in the
covers to get to it. It's usually used to "pair" the mouse and
dongle, but that's not needed here. Might be useful to send an event
that will trigger a macro that will start/stop the recorder.

Incidentally, forget about buying a wireless mouse and using the
dongle part with the freely downloadable software. The firmware
inside is highly customized.

I'm currently trying to figure out the best way to attach an external
antenna without destroying it.

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558

Jeff Liebermann <(E-Mail Removed)> wrote:
>William P.N. Smith <(E-Mail Removed)> hath wroth:
>>Jeff Liebermann <(E-Mail Removed)> wrote:
>>>| http://802.11junk.com/jeffl/pics/wir...Spy/index.html

>I'm currently trying to figure out the best way to attach an external
>antenna without destroying it.

Looks like you could just cut the antenna away where C{2,3,4} come
together and pick up a ground at a bunch of nearby points, just attach
an SMA (or whatever) connector there.

I was also wondering about putting the whole thing inside a Pringles
(or whatever) can for some gain and directivity...