Wireless Diagnostics with Apple iPhone/iPad and iOS 13

Regardless if you're using iOS 13 or iPadOS, you'll be able to gather more or less helpful data on your wireless network. The most simple way is obviously to review the output in Settings → Wi-Fi, but this doesn't really go much beyond the IP address of your device. This article will highlight various ways to collect extensive data on your (and surrounding) wireless networks and how the iPhone rates the connection to my Alcatel-Lucent Enterprise Stellar Wireless Access Points. This article contains knowledge acquired by reading this valuable blog article.

On your device, you can navigate to Settings → Data Privacy → Analysis → Analysis Data → WiFiConnectionQuality-xxxx-xx-xx-xxxxxx.ips (my iOS runs in German, I hope this translation is accurate).

This report will contain geo-coordinates of your Wireless LAN, therefore you should consider your privacy when transmitting/forwarding this kind of file. The nice thing is that this doesn't require any additional profiles or similar and is regularly created.

The advanced analysis requires you to add a specific profile to your iPhone/iPad. This profile can be obtained via the Apple-Website with your Apple-ID after you've accepted the „Developer License Agreement“. This profile gives you access to previously hidden/inaccessible menus & functions in your iOS. You may want to check it out via Settings → Wi-Fi → Diagnostic Mode or Settings → Wi-Fi → (your connected wireless) → Diagnostics.

• Identifies the Access Point the iPhone is currently connected to

• Tells you on which channel the Access Point operates and with which channel width (e.g. 80 MHz)

• Signal Strength (RSSI in dBm) with color indication and written indicator (e.g. Strong, Moderate, Weak)
• Below you'll see an indication how the channel utilization is being rated/seen

• Information on how the wireless network is secured e.g. „WPA3 Personal“

• Information if you go through a Captive Portal to connect to the network

• Information if the Wireless LAN operates with multiple Access Points (Multi AP) or a single AP (Single AP)

• Stationary (the iPhone doesn't move e.g. stationary on the desk)
• Moving (the iPhone is being held in hand)
• Walking (the iPhone moves with walking speed)
• Running (the iPhone moves with running speed (also happens if you jump with the device))

• Information on how much time it takes to get to your Gateway

• Information on how much time it takes to get to the internet (apple.com)

• AWDL stands for „Apple Wireless Direct Link“ and is used for AirDrop
• Active or Inactive

• Idle

• Active or Inactive
• Directly below you'll find an indication which application triggered the last scan e.g. locationd and when this happened

If you create logs manually via the above mentioned function, you'll find those after a Sync with iTunes (Sync, not Backup!) in the following directory /Users/<Username>/Library/Logs/CrashReporter/MobileDevice/<Name of mobile device>/CoreCapture/. The folder name contains your comment and a date/timestamp of when it was created e.g. [2019-10-19_13,57,04.553800]=bedroom.

I especially liked the records of the DriverLogs (./Data/com.apple.driver.AppleBCMWLANCoreV3.0/DriverLogs) with filename e.g. [2019-10-19_13,54,22.346852]-AppleBCMWLAN_Logs-001.txt.

In this file you'll find which Access Points the iPhone can see and that it added them to the „roaming candidates“ and which signal strength the various APs are seen with.

Oct 19 13:56:33.810924 +0200 066100.605500 wlan0<N>[62189] constructNeighborCacheFromBeaconCache@6430:Roam candidate# 0 DC:08:56:00:1B:D9 on channel 100  RSSI: -65
Oct 19 13:56:33.810933 +0200 066100.605509 wlan0<N>[62190] constructNeighborCacheFromBeaconCache@6430:Roam candidate# 1 DC:08:56:00:29:11 on channel 11  RSSI: -68
Oct 19 13:56:33.810940 +0200 066100.605516 wlan0<N>[62191] constructNeighborCacheFromBeaconCache@6430:Roam candidate# 2 DC:08:56:00:29:21 on channel 116  RSSI: -69
Oct 19 13:56:33.810946 +0200 066100.605522 wlan0<N>[62192] constructNeighborCacheFromBeaconCache@6430:Roam candidate# 3 DC:08:56:00:29:19 on channel 36  RSSI: -75
Oct 19 13:56:33.810951 +0200 066100.605527 wlan0<N>[62193] constructNeighborCacheFromBeaconCache@6430:Roam candidate# 4 DC:08:56:00:1B:D1 on channel 11  RSSI: -76
Oct 19 13:56:33.810956 +0200 066100.605532 wlan0<I>[62194] dumpNeighborCache@6609:Neihgbor Cache Channels 100
Oct 19 13:56:33.810960 +0200 066100.605536 wlan0<I>[62195] dumpNeighborCache@6609:Neihgbor Cache Channels 11
Oct 19 13:56:33.810963 +0200 066100.605539 wlan0<I>[62196] dumpNeighborCache@6609:Neihgbor Cache Channels 116
Oct 19 13:56:33.810966 +0200 066100.605542 wlan0<I>[62197] dumpNeighborCache@6609:Neihgbor Cache Channels 36

Another interesting file is the ConfigManagerState.txt available in the following directory: /Users/<Username>/Library/Logs/CrashReporter/MobileDevice/<Name of mobile device>/CoreCapture/WiFi/[2019-10-19_13,57,04.553800]=bedroom/Data/com.apple.driver.AppleBCMWLANCoreV3.0/StateSnapshots/ConfigManagerState.txt

This file gives away under which circumstances an Access Point becomes a roaming candidate and and which thresholds trigger a roaming event.

Prefer 5GHz threshold parameters from device tree: rssiThreshold = -65 rssiAdjustment = 30
default roam params from device tree: flags = 0x0001 fullRoamScanPeriod = 90 partialRoamScanPeriod = 30
	roamResetRSSIDelta = 7 fullRoamScanCount = 2 txFailTrigger = 0
	2.4 GHz: rssiTrigger = -75 rssiQualDelta = 20
	5 GHz: rssiTrigger = -75 rssiQualDelta = 10
Enterprise roam params from device tree: flags = 0x0001 fullRoamScanPeriod = 90 partialRoamScanPeriod = 30
	roamResetRSSIDelta = 7 fullRoamScanCount = 2 txFailTrigger = 0
	2.4 GHz: rssiTrigger = -70 rssiQualDelta = 12
	5 GHz: rssiTrigger = -70 rssiQualDelta = 12
2.4GHz Roam profile[0]: RSSI:[-10,-75], Flag:0xc, ScanParams:(2,3000,180,2,1200), Candidate:(20,-65,50)
2.4GHz Roam profile[0]: RSSI:[-75,-128], Flag:0x10, ScanParams:(2,90,30,2,180), Candidate:(12,-65,50)
5GHz Roam profile[0]: RSSI:[-75,-128], Flag:0x10, ScanParams:(2,90,30,2,180), Candidate:(12,-128,10)
2.4GHz Roam profile[1]: RSSI:[-75,-128], Flag:0x14, ScanParams:(2,90,30,2,180), Candidate:(12,-65,50)
5GHz Roam profile[1]: RSSI:[-75,-128], Flag:0x14, ScanParams:(2,90,30,2,180), Candidate:(12,-128,10)
2.4GHz Roam profile[2]: RSSI:[-10,-75], Flag:0xc, ScanParams:(2,3000,180,2,1200), Candidate:(20,-65,50)
2.4GHz Roam profile[2]: RSSI:[-75,-128], Flag:0x14, ScanParams:(2,90,30,2,180), Candidate:(12,-65,50)
5GHz Roam profile[2]: RSSI:[-75,-128], Flag:0x10, ScanParams:(2,90,30,2,180), Candidate:(12,-128,10)
2.4GHz Roam profile[3]: RSSI:[-10,-50], Flag:0xc, ScanParams:(2,1200,180,2,600), Candidate:(20,-65,50)
2.4GHz Roam profile[3]: RSSI:[-50,-70], Flag:0xc, ScanParams:(2,1200,180,2,360), Candidate:(15,-65,50)
2.4GHz Roam profile[3]: RSSI:[-70,-128], Flag:0x10, ScanParams:(2,90,30,1,30), Candidate:(12,-65,50)
5GHz Roam profile[3]: RSSI:[-70,-75], Flag:0x0, ScanParams:(2,90,30,1,30), Candidate:(12,-128,0)
5GHz Roam profile[3]: RSSI:[-75,-128], Flag:0x10, ScanParams:(2,90,2,2,30), Candidate:(12,-128,10)
 AWDL Always ON: N/A   Priv Elect: N/A   Restricted to infra channel:  N/A  Restricted Feature Set: N/A   Elect Metric: 0 
DFS Proxy Support Enabled:YES 	
Motion Profile States from device tree: frozen = 0 Moving = 16  walking = 32  driving = 48

If you press (and hold) the buttons „volume up“, „volume down“ and the „wake-up/Siri“-button until the iPhone confirms this action with a short vibration, you'll find very extensive logs after your next iTunes Sync.

The resulting file (archive) can be found in the following folder /Users/<Username>/Library/Logs/CrashReporter/MobileDevice/<Name of mobile device>/DiagnosticLogs/sysdiagnose and you have to decompress it sysdiagnose_2019.10.20_15-44-29+0200_iPhone-OS_iPhone_17A878.tar.gz.

The folder „WiFi“ contains very interesting files/output on the connected and surrounding networks.

Here is an example output from diagnostics-environment.txt

# --- Diagnostics

————————————————————————————————————————————————————————————————————————————————————————————————————————
Timestamp    Name                          Duration    Result    Description                            
————————————————————————————————————————————————————————————————————————————————————————————————————————
Congested Wi-Fi Channel CCA                0.394       No        15:45:03.122        Current channel (100) is NOT congested (CCA = 0.0% congested)
                                                                                     Recommended 2.4GHz — 6
                                                                                     Recommended 5GHz — 165
HT40 2.4GHz Networks                       0.011       No        15:45:03.517        Did not find HT40 network(s) in 2.4GHz
Conflicting Wi-Fi CC                       0.002       Yes       15:45:03.529        Found conflicting country code(s) (de)
                                                                                     'Vodafone-79AC' — 88:71:b1:a4:12:6a (EU)
                                                                                     'Vodafone-79AC' — 88:71:b1:a4:12:6b (EU)
Hidden Wi-Fi Scan Results                  0.000       No        15:45:03.531        Did not find any hidden networks
No Scan Results                            0.000       No        15:45:03.532        Wi-Fi networks are visible
Conflicting PHY Mode 11ac                  0.006       No        15:45:03.532        0 PNL networks have conflicting PHY modes (802.11ac).
Conflicting PHY Mode 11n                   0.007       No        15:45:03.539        0 PNL networks have conflicting PHY modes (802.11n).

The file „wifi_scan_cache.txt“ contains a full overview of all surrounding wireless networks that the iPhone can see, with which signal strength and which security parameters.