Raw frames

Raw frames is a record type that only an NS Scout can record. The Scout passes the 802.11 frames it hears to the phone, and the app saves them as pcapng files you can open in Wireshark or any tool that reads pcapng.

The tile reads “802.11 frames as pcapng, Log files only”. Like Wi-Fi clients, it only shows while a Scout is paired, and it records only while the Scout is the Wi-Fi source (otherwise the tile reads Needs NS-ABCD).

Turning it on

Raw frames hold more about other people’s devices than any other record type, so the app asks first:

Save raw Wi-Fi frames? Raw frames include the addresses and network names of nearby devices, including other people’s. They’re saved only to log files on this phone and never sent anywhere.

Tap Save raw frames to turn the tile on, or Cancel. The same question comes up when you turn it on in Change setup during a survey and when you pick a saved setup that includes it. It is not asked when your organization turns Raw frames on.

Log files only

Raw frames are saved only by the Log files destination. They are never sent to NS Analytics, MQTT, gRPC or the community databases.

With Log files off, the tile reads Turn on Log files to save these, and a survey writes no raw frames file at all. A survey that sends only to MQTT, for example, never creates one.
While the setup saves raw frames, the Log files row reads “CSV and pcapng on this phone”.
Another app can’t start raw frames. A start request that names them leaves them out and starts the rest. See Intent API.

What is captured

The app uses the Scout’s defaults for raw capture:

Management frames only: beacons, probe requests and responses, action frames and the like. No data or control frames.
Each frame cut to a maximum length (at most 512 bytes), which the Scout sets from the Bluetooth link.
A rate limit on the Scout, so raw frames leave room for the rest of the capture on the Bluetooth link. Frames over the limit are dropped on the Scout and counted as raw frames dropped under Now > Data missed on the NS Scout page, so in a busy place the Some data missed line can turn on while Raw frames is on.

Raw frames are not survey records: they are not counted in the survey’s record total or the record type bars, and they carry no location.

The files

Each file is named craxiom-wifi-raw-YYYYMMDD-HHMMSS.pcapng and sits with the CSV files in Download/NetworkSurveyData/csv. A file is created when the first frame arrives.
A new file starts when the current one reaches the Start a new file every size on the Log files page, like the CSV files.
Each file is pcapng with 802.11 frames and radiotap headers (link type 127). The radiotap header carries the frequency, the signal and noise levels and the rate. The interface is named after the Scout’s ID, like NS- followed by 12 hex digits, and timestamps have microsecond resolution.
The Log files page lists these files with the survey that wrote them, marked “Raw frames (pcapng)” with their size, and shares them like the CSV files. Raw frames files grow quickly.

While recording

The Records panel shows a line for raw frames under the record type bars, for example “Raw frames · 12,480 saved · 38 MB”.

If the phone runs low on storage (under 100 MB free), saving stops and the line reads Storage full: “This phone is almost out of storage, so raw frames stopped saving. The file so far is kept. Free up space, then start a new survey to save more.” Everything else in the survey keeps recording. If the file can’t be written for another reason, the line reads Stopped.

If raw frames never make it to a file, because the phone fell behind writing them or the Bluetooth link lost some, a second line says how many, for example “12 raw frames dropped”. A lost Bluetooth packet counts as one frame, so the real number can be higher.

Managed phones

The managed configuration key survey_wifi_raw sets this record type like the other survey_* keys. On a managed phone, Raw frames is off unless the organization sets the key. Set to on, it also applies to a survey another app starts. See Managed configuration (MDM).