Rapid Wi-Fi Spot Scanning

As part of a larger project I had to build a WLAN scanner that would grab the BSSID of the available hotspots and their respective RSSI in the nearby area. The initial plan was to use the WLAN API in Windows XP. This was quite an issue as some of the cards were not using a NDIS wrapper driver and rather had their properitery driver. Netstumbler was a good option, but we needed to customise the interface and feed the scan data into another program. So eventually we ended up using code from the InSSIDer project. Btw, this has a neat set of .NET wrapper or P/Invoke libraries to access the XP WLAN API.

Despite having built a simple console based WLAN scanner, the scanning speed was limited by the Windows XP's inherent constraints. Any subsequent scan did not refresh the BSSID table untill like 60 seconds have passed after the previous scan. Damn! this is a problem, if we are doing warchalking in a car, we would have passed a few meters in 60 seconds! The next option is to use a linux distro and do a shell script to capture the data but then we would need to have another netbook run XP for someother programs.

Eventually I decided to resort to a hardware based solution to this. I purchased a serial WLAN module from Roving Networks (via SparkFun online shop) along with a SiLabs TTL to UART to USB bridge. Hooked these two of them and viola! now I have a USB based WLAN scanner module.

The CP2102 USB to serial bridge, the cool thing about it is the XP device driver sets it up as a 115200bps virtual serial port and it has a on-board 3.3V to power the WLAN module.

The CP2102 is wired to the Serial Wi-Fly module from Roving Networks, just nicely the Wi-Fly module can be powered by 3.3V



Ooh..blinky lights! The combo in action. The USB powers both the CP2102 and the Wi-Fly module, notice that the WLAN module has a 1/4 wave antenna!

This is the output on the hyperterminal window. You would need to issue "$$$" which puts the WLAN module in command mode. Since I am basically using the module to do scans and not associate it with any access point, I just issue a scan 30 command, where the 30 is the number of miliseconds to scan a channel. I have tried lower than 30 but like 10 often 'hangs' the module and found 30 to 50 do a nice job. Next task, write a C# program to interface to the module, parse the command output and store them onto a SQL database.