Probe access is exclusive, and the amount of wireless data forwarded to the console during packet capture is substantial, so the product doesn't scale well. WildPackets recommends a dedicated network infrastructure, but the extra administrative burden doesn't make sense for most companies. Also annoying is the requirement to keep monitor mode on all the time just to perform wireless security monitoring. AiroPeek NX does a reasonable job detecting symptoms of attacks when performing a packet capture, but it can't group alarms by device except in packet-capture mode, and it doesn't provide any way to look at historical alarm data.
WildPackets recently announced a new distributed monitoring system, called Omni3, which addresses many of the limitations of the RFGrabber. This system looks like a significant upgrade, it wasn't available in time for testing.
AiroPeek NX 2.0.2 & RFGrabber 1.1. WildPackets, (800) 466-2447, (925) 937-3200. www.wildpackets.com
Network Instruments says it doesn't consider Wireless Observer a point product, and our assessment confirmed that. Until now, the company's focus has been on packet analysis and monitoring of wired segments, and it says it sees the wireless probe as a natural extension of its WAN, Ethernet and Gigabit Ethernet probes.
The company subscribes to a two-tier infrastructure, with Observer as the core engine and console and probes to gather data. The wireless probe we received was a Microsoft Windows XP computer crammed into a compact box with an 802.11a/b/g wireless PCI card. Rack-mounted and software-only versions of the probe also are available.
Wireless Observer could be useful for administrators with concerns about a particular location and who want ongoing packet analysis. Under those conditions, one of the systems could be installed in an office or wiring closet, serving as a temporary remote monitor. However, we don't see this box going up in ceilings around the country, and not just because it would cause said ceilings to fall on heads--because of the probe design and pricing model, Expert Observer is more than three times as expensive as its closest competitor, WildPackets, in our second pricing scenario.