There's some great new inclusions in the latest WiFi Scanner by Accessagility, taken from the 802.11 Information Elements (IE) of Beacon Frames. Below are the ones I find most useful:
Client Count
I walk into a populated lecture hall. 400+ devices across 4 AP's/8 Radios. Typically, I look at my infrastructure to check the client distribution across those AP's, whether Cisco Prime, AMP or similar. I still might do that, but with this tool I now have much easier access to that data, assuming I can hear Beacons from all AP's. Also, if I'm not the owner of the infrastructure, it gives me the opportunity to see the client distribution amongst the AP's in the area. Something I always want to check is if the clients are being distributed amongst the available radios as much as possible (most vendors market some form of anti-sticky client features). This allows me to check that without logging in to anything. This is pulled from the 'QBSS Load Element' (QoS Enhanced BSS) portion of the Beacon:
QBSS Load with 6 Clients on this BSSID
Channel Utilization
This is CU from the AP's perspective...something a client can never tell you. If I see that an AP is showing very high CU (80+%) that tells me something. It may be nothing but a high number of clients, or even a single flow, however it may be something to take a closer look at. This is the AP's view of the percentage of time the channel is sensed to be busy by either Physical (Energy Detect) or Virtual (NAV) Carrier Sense. This is also take from the QBSS Load IE, and is normalized to 255 (eg divide the number by 255 to get CU %):
81% Channel Utilization
AP Name
Now common in both Enterprise and non-Enterprise tools, this is incredibly useful during a post-install survey. Being able to identify signal strength to AP's without the need to tie a BSSID back to an AP is much easier, especially if your AP's are named according to location. The name of this IE will depend on your vendor:
AP Name (ap-cbca-106-5)
802.11r
This is more of an "informational" thing. If I saw an SSID with this enabled, and I was on a device which supported it, I'd be more prone to connect to that (if Fast Secure roaming was of importance). The presence of the Mobility Domain Information Element (MDIE) indicates the support of 802.11r, including whether Over-the-Air or Over-the-DS is in use:
MDIE (Over-the-Air)
Protection Mechanisms
Like .11r I'd put this in the "informational" bucket. In certain situations you will want to know when your AP's are "protecting" and what they are protecting against (eg Mode). You'd go to another tool for further investigation, but being able to tell from a scanner application just makes it easier to discover. This is taken from the 'HT Information' IE:
Mode 1 Protection in place





