Wireless Tools · Topic 3 of 3
Wireless Align and Sniffer
Learn how the RouterOS wireless align tool helps point antennas and how the wireless sniffer captures frames to a file or a remote analyser.
- 5 min
- Align helps you point an antenna by giving live signal feedback.
- Alignment uses the interface mode
alignment-only. filter-maclimits the tool to one remote device.
What it is
Align helps you point an antenna at the far end, and the sniffer captures wireless frames for analysis.
Align is a tool for installation. It gives live feedback on signal strength so you can aim a dish or a directional antenna.
The sniffer is a tool for troubleshooting. It records what is on the air so that you can study the frames afterwards.
How it works
Align uses a special interface mode, and the sniffer records frames on the channel the radio listens to.
Why alignment matters
A narrow beam antenna must point exactly at the other end. A few degrees of error can cost many dB. You can read signal strength from the registration table, but it is awkward to do that while standing on a mast.
Align gives you easier feedback. It can show the received signal and it can also give an audio signal, so you can listen to the pitch while you move the antenna.
Alignment mode
For alignment you set the interface to the mode that exists for it:
/interface wireless set wlan1 mode=alignment-onlyIn this mode the interface sends special frames and listens for them, instead of acting as an ordinary access point or station. The align tool then reports the signal it receives from the remote device.
Settings of the align tool include these:
| Setting | Purpose |
|---|---|
filter-mac | Listen only for frames from one device |
audio-monitor | Give audio feedback for the chosen device |
receive-all | Show every wireless device that is heard |
ssid-all | Show all SSIDs |
active-mode | Send frames as well as listen |
frame-size | Size of the frames used by the tool |
At each end of the link you run the tool and set the other end's address as the filter. One person moves the antenna, and the other watches or listens.
Set filter-mac to the remote device so that other networks do not distract you while you aim the antenna.
Finishing alignment
When the signal is as strong as it can be, fix the antenna. Then change the interface back to its working mode, for example ap-bridge or station, and check the link with the registration table.
Forgetting to restore the mode is a classic mistake. The device stays in alignment mode and does not serve clients.
The sniffer
The sniffer captures the frames that the radio can hear. It is used when the registration table and counters do not explain a problem. You can look at what clients and access points actually say to each other.
/interface wireless sniffer set file-name=captureYou choose the wireless interface and the options, such as the file name, in the sniffer settings. Then you start the capture on that radio, and stop it when you have enough. The result is a capture file that you can open in a packet analyser. The sniffer can also stream packets to a remote analyser instead of writing a file, using its streaming options.
Sniffer options
| Option | What it does |
|---|---|
file-name | Writes the capture to a file |
streaming-enabled | Sends the capture to another computer |
streaming-server | Address that receives the stream |
only-headers | Keeps headers and saves memory |
channel-time | How long to stay on each channel when the sniffer moves between channels |
A file lives in the memory of the router, so keep captures short, and use only-headers where you can. Streaming avoids filling the memory, but it adds traffic to your network.
The sniffer uses the radio like the scan does, so a live interface may stop serving clients while it captures.
What to look for in a capture
A capture lets you see the exchange when a client connects: probe requests, authentication, association and the data that follows. Repeated frames show retries. Deauthentication or disassociation frames show who ended a connection.
This is much stronger evidence than a guess. It is useful for security problems and for clients that connect and then drop.
What to remember for the exam
Six facts cover align and the sniffer.
- Align helps you point an antenna by giving live signal feedback.
- Alignment uses the interface mode
alignment-only. filter-maclimits the tool to one remote device.audio-monitorgives sound feedback while you move the antenna.- The sniffer captures wireless frames to a file or sends them to a remote analyser.
- Both tools use the radio, so the interface may not serve clients at the same time.
Common mistakes
Four errors are typical.
Aligning without a filter. Other devices appear and confuse the reading.
Forgetting to change the mode back. The link never comes up after the work.
Filling the router memory. A long capture stored in memory can use all of it.
Sniffing on a live access point. Clients may be dropped while the radio is capturing.
Check yourself
Work through these three questions.
What is the purpose of the align tool?
It gives live signal feedback, and optionally sound, so you can point an antenna at the far end. It works with the
alignment-onlyinterface mode.Why set
filter-macin the align tool?It makes the tool listen only for the chosen remote device. Other networks then do not confuse the reading.
How can the sniffer send its capture somewhere other than a file?
It can stream the packets to a remote analyser by using its streaming options. This avoids filling the memory of the router.
Topic 3 of 3 in Wireless Tools
Test yourself on Wireless Tools
The full MikroTik MTCWE question bank has 447 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.