- Up All Night Robotics presents: (Russian)

802.11b/g Wifi Spectrum Scans

This web page shows some scans I took with my "Poor Man's Wifi Spectrum Analyzer" (Proxim 7400 RangeLan2 running its Snoop utility).
I found these spectrum scans to be quite interesting. Because of the results, I plan to connect the RangeLan2 card to a better antenna while conducting site surveys, to determine which channels are clear of not just Wifi packets but also of ANY interfering signals.

Table of Contents:

Wifi Scans
Other 2.4 GHz Devices

Wifi Scans

These spectrum scans show why the U.S. does not allow using channel 14 for Wifi devices, which clearly extend above the U.S. 2.4 GHz ISM band. It is not clear why channels 12 and 13 are not permitted, because they seem to stay well within the 2.4 GHz ISM band used by FHSS (Frequency Hopping Spread Spectrum) networking and other devices. I suspect that the FCC does not allow radiated energy that is below the sensitivity of the receiver used to make these scans, which extends well outside the visible frequencies shown here.

To make the scans, I used OpenWrt in client mode to "broadcast" probe requests on a single channel at a time, while I did slow scans with the Snoop utility (spectrum analyzer). The laptop running the scans was 3 feet from the OpenWrt box, in my basement (to minimize interference on non-U.S. channels). I do not use channels above 11 upstairs or outside. Here is the command to make OpenWrt broadcast probe packets on channel 6 (change the '6' to whatever channel you want to use):

while :;do wl scan -c 6 2>/dev/null;done

Below are screenshots of the wifi frequency spectrum scans made from these probe requests.

802.11b/g Wifi channel 1

802.11b/g Wifi channel 6

802.11b/g Wifi channel 11

802.11b/g Wifi channel 12

802.11b/g Wifi channel 13

802.11b/g Wifi channel 14

You can see in this screenshot that the bell curve of the signal extends past the high end of the 2.4 GHz ISM band. For this reason, this channel should not be used for Wifi in the U.S. under any circumstances, even though some Wifi devices with custom firmware allow you to select this channel.

Other 2.4 GHz Devices

In the U.S., the older FHSS (Frequency Hopping Spread Spectrum) networking uses 75 non-overlapping channels 1 MHz wide, across the entire 2.4 GHz ISM band. In Europe, it is restricted to far fewer channels due to less avalable bandwidth.

Also in the U.S., the newer DSSS (Direct Sequence Spread Spectrum) used by 802.11b/g uses 14 overlapping channels 5 MHz apart but 30 MHz wide. That gives only 3 non-overlapping channels (1, 6, and 11), which are clearly visible in the wifi frequency spectrum scans above. Some other countries allow 14 channels, and some allow fewer than 11 channels. OpenWrt, DD-WRT, and other custom firmwares allow 14 channels, but the last 3 channels should not be used in the U.S. except for testing purposes at reduced power levels or with a dummy load.

Other devices that share the 2.4 GHz ISM band include microwave ovens, cordless phones, wireless baby monitors, wireless television transmitters, and more. Below are screenshots of wifi frequency spectrum used by some of these other devices.

2.45 GHz Microwave Oven

I scanned my new 800 Watt microwave oven at high power level from 6 feet away. On slow scans, each channel is monitored for one second before stepping to the next higher channel. The dropouts pictured above occured when the loud hum periodically got quiet for several seconds. On each pass of scan, the dropouts occured at different frequencies.

The microwave oven must have a thermal cutout that turns off the radio power for a few seconds. Lower power settings have much longer dropouts that reduce the average power level, but still show full power while the microwave oven is "humming". It looks like the oven radiates all across and outside the ISM band, and has higher power levels than my router running at 75 mW output.

5.8 GHz cordless phone, slow scan

Tonight, I left the 5.8 GHz cordless phone off the hook in another room about 50 feet from my "poor man's wifi spectrum analyzer". As seen in the screenshot above, a slow scan (about one channel per second) shows the phone broadcasting on almost every one of the 75 FHSS channels. It annoys me greatly that most 5.8 GHz cordless phones use 2.4 GHz for the return channel, without mentioning that fact anywhere on the box or in the manual. That's why I bought an analog 900 MHz phone shortly after I learned why the 5.8 GHz seemed to not work well around wifi equipment. Analog phones do not get dropouts, but instead some occasional noise that you can still hear over and can minimize by repositioning the phone.

When I bought my 5.8 GHz cordless phone, I noticed immediately that it only worked well when it was about 3 feet or less from its base station cradle, and not well at all near any 802.11b wireless network devices. The store where I purchased it said I had 30 days to return it with the receipt, which I had promptly misplaced. When I found the receipt it was too late to return it to the store. ;-(

The scan above shows that the cordless phone at 50 feet has a higher power level than the microwave oven at 6 feet, and a higher peak power level than my wireless router at 3 feet while broadcasting probe requests at 75 mW. Wifi devices seem to be at a disadvantage when comparing peak energy levels, but in reality Wifi spreads that energy over a much wider bandwidth resulting in smaller peak amplitude, and interference is minimal between DSSS wifi devices and FHSS devices such as cordless phones. That is why both kinds of devices can coexist relatively peacefully in the same band, as can be seen in the following screenshots.

5.8 GHz cordless phone, fast scan

At fast scan rate (many channels per second), the scanner typically sees the phone only on one or two random channels, which indicates that the phone is also frequency-hopping with a different pattern and only occasional channel overlap. This also shows that very little of a 30 MHz wide Wifi signal is overlapped by a FHSS signal at any time, causing minimal actual interference.

The fast scan rate covers the entire band in a few seconds, but misses a lot of stuff. Even normal wifi packets are often missed because it sniffs a lot of channels between packets when there is no visible signal energy in that channel. A slower scan rate is needed to allow enough time for a FHSS (narrow-band frequency-hopper) device to cycle through its pseudo-random sequence and hit the currently monitored channel, or for a DSSS (wifi) device to broadcast at least one packet. Alternatively, sweeping the entire band many times per second with a *real* spectrum analyzer will sample every channel before the signal moves, but these also cost *real* money (that's why I added a Paypal "Donate" button to my web page).


5.8 GHz cordless phone, medium scan

While using the medium scan rate (several channels per second), the scanner typically sees the phone only on about one-third of the 75 channels. Although this is the default speed of the Snoop utility, it does not clearly show which channels a frequency-hopping device uses. A slow scan is needed to be sure that a frequency hopper has a chance to hit a channel while it is monitored.

Different devices such as wireless video cameras and 2.4 GHz analog phones may have different characteristics than is seen in the above 2.4 GHz ISM band frequency spectrum scans.


I got my RangeLan2 PCMCIA card with antenna off ebay for $6.95 plus $5 shipping. It took some trial and error and google searching to get it working with WinXP, but it works fine now using an older Win2K driver (the newest Win2K driver has BSOD problems on WinXP). I have it running on a 500 MHz IBM ThinkPad laptop I got at a garage sale last year for five dollars.

My $5 laptop has the following built-in peripherals: 5.7 GB Hard Disk, CD-ROM drive, 100 Base-TX LAN adapter, 56K modem, dual side and back USB ports, 800x600 TFT color LCD, TrackPoint mouse, 128 MB RAM, and it came with genuine WinXP Pro. When I asked "why so cheap?", they said "The kids all got new laptops, and we don't need it."

The laptop was cheaper than the RangeLan2 card. The total cost of my "Poor Man's Wifi Spectrum Analyzer" (including laptop computer) was only $11.95 plus $5 shipping! I don't know about you, but I consider that a bargain. ;-)


Proxim 7400 under Windows XP (thanks AndyK):

SD floppy details here:

My OpenWrt mmc driver status:

My 802.11b/g Wifi Spectrum Scans: Home



To see more cool stuff, please support this website.
- Rob Wentworth
- (uanr<at>RobWentworth<dot>com)
- This web page created 2006-Oct-07, latest update 2006-Oct-08.